Subsequent analysis confirmed the reliability of the questionnaire items - Cronbach's alpha for all six factors ranged between 0.72 and 0.90. Our first approach to assessing the security needs of an organization was based on the long tradition of risk assessment, wherein the risk from a particular threat is defined as the product of the likelihood of the threat and the severity of the threat. The product of likelihood and severity ratings for a specific threat measures the risk ascribed to that threat. The sum of the risk measures for all five threats yields the total risk assessed by this approach. This total risk measure is one of the potential predictors of the level of computer security practices in organizations.
Confidentiality addresses the release of potentially sensitive information.
For instance, some health records should be released to doctors but not to insurance firms or employers - release of the information to the latter would constitute a breach of confidentiality. Integrity requires that the information be tamper-proof. For example, faculty should be able to update the grades obtained by students, but the students themselves should not. In this paper, we investigate whether these CIA ratings predict the observed level of computer security practices in organizations. The survey questionnaire was sent to a convenience sample of 90 organizations in Singapore.