The product of likelihood and severity ratings for a specific threat measures the risk ascribed to that threat. The sum of the risk measures for all five threats yields the total risk assessed by this approach. This total risk measure is one of the potential predictors of the level of computer security practices in organizations. Confidentiality addresses the release of potentially sensitive information. For instance, some health records should be released to doctors but not to insurance firms or employers - release of the information to the latter would constitute a breach of confidentiality.
Integrity requires that the information be tamper-proof.
For example, faculty should be able to update the grades obtained by students, but the students themselves should not. In this paper, we investigate whether these CIA ratings predict the observed level of computer security practices in organizations. The survey questionnaire was sent to a convenience sample of 90 organizations in Singapore. The median level of experience of respondents in their current line of work was 6 years. A total of 58 respondents provided complete responses to the risk assessment section of the questionnaire.