# Educational Organization's Security Level Estimation Model
## 3 Proposed Security Level Estimation Model
### Criteria Value Normalization Methods
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Criteria Value** & **Description** & **Normalized Value** \\ \hline No data are stored & No data are stored or used in & 1.0 \\ \cline{3-3} \multirow{3}{*}{Stored data are insensible} & No secret or personal information is stored or & \\  & used, as only insensitive data are stored or & \\ \cline{3-3} \multirow{3}{*}{Stored data are insensible} & used (sensitive data are anonymized & \multirow{3}{*}{0.5} \\  & and untraceable). & \\ \cline{3-3} \multirow{3}{*}{Sensitive, personal, private data are stored} & Data related to persons’ private data, health & \\ \cline{3-3} \multirow{3}{*}{Sensitive, personal, private data are stored} & records, private organizations data, or other & \\ \cline{3-3} \cline{3-3}  & sensitive data are stored or used. & \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Criteria value association to normalized value for sub-criteria data sensibility. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Criteria Value** & **Description** & **Normalized Value** \\ \hline Globally publicly available & System available on the Internet and is indexed & 0.00 \\  & by search engines. & \\  & The system is available on the Internet, but is & \\ \cline{3-3} Secretly publicly available & not available for indexing, uses an IP address & 0.25 \\  & rather than the domain name. & \\ \cline{3-3} Only locally available & The system is available in a local network only. & 0.50 \\ \cline{3-3} Locally available via VPN & The system is available by using a virtual & 0.75 \\ \cline{3-3} \multirow{3}{*}{Not available} & private network only. & \\ \cline{3-3} Not available & The system is turned off or has not been & 1.00 \\ \cline{3-3} \cline{3-3}  & accessed in the network. & \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Criteria value association to normalized value for sub-criteria system access. used systems and 10 (2). Therefore, all used systems should be scanned for vulnerabilities and the maximum SVSS score should be found from the possible ones. \[nv(x)=1-\frac{max\bigg{(}max\Big{(}cross_{i(j)}\Big{)}_{i(x)}\bigg{)}}{10} \tag{2}\]  
where \(nv(x)\) is the normalized value for vulnerability maximum score for group \(x\), \(x(i)\) is the \(i\)-th system in group \(x\), \(cross_{i(i)}\) is the \(j\)-th common vulnerability scoring system v3.0 score for system \(i\). The number of vulnerabilities has no precise range. Therefore, the normalized value for criteria, based on the number of vulnerabilities are calculated as the relative frequency of vulnerabilities between analyzed alternatives (3). To obtain the normalized value \(nv\) the number of vulnerabilities for each system must be presented for all alternatives. Then the number of vulnerabilities in the current alternative is divided by the maximum number of vulnerabilities in all analyzed alternatives. \[nv(x,\ a)=1-\frac{\sum pc_{i(x,\ a)}}{max\Big{(}\sum pc_{i(x,\ j)}\Big{)}} \tag{3}\]  
where \(nv(x,a)\) is the normalized value for vulnerability number for alternative \(a\) and group \(x\), \(vc_{i(x,\ a)}\) is a count of vulnerabilities for system \(i(x,\ a)\), analyzed in group \(x\) for alternative \(a\), \(vc_{i(x,\ j)}\) is a count of vulnerabilities for system \(i(x,\ j)\), analyzed in group \(x\) for the \(j\)-th alternative of all analyzed alternatives. This normalization method impacts the recalculation of all normalized vulnerability number values when the additional alternative is added or some of them are eliminated. At the same time, it limits the method's possibility to present a global rather than relative security level, as the question of maximum vulnerability number is open all the time.