# Educational Organization's Security Level Estimation Model
## 3 Proposed Security Level Estimation Model
### Criteria Importance Estimation  
While possible criteria values are estimated and normalized based on some theoretical or logical background, the estimation of criteria importance has an empirical background. To estimate the criteria importance four security management experts were involved (E1, E2, E3, and E4). All four experts defended their Ph.D. thesis in the field of information security management within the last 5 years. Currently, they all work in an industry, in positions, related to security and/or its risk management. Based on [PERSON] and [PERSON] (2009), one judge/expert is enough when the AHP method is used. However, to estimate the experts' opinion similarity to a wider range of security risk experts, all known security risk management experts were incorporated into this process. Because of time constraints and expert needed competence requirements, only four experts were selected. The requirements were to have a Ph.D. degree in a topic related to security management and to work in a security management-related position at the moment. Therefore, Ph.D. defense history in Lithuania during the last 10 years was analyzed. Suitable candidates were contacted and invited to participate in the research. Data on experts' work experience were gathered as well to identify possible relations between the experts. Two experts appeared to be working in the same company, however, they are responsible for different responsibilities and there is no subordination between them (they work in different departments). One of the experts provided two rather than one opinion on criteria importance. The need for two different sets was explained by the fact that higher education and secondary school education institutions have different experiences, therefore, different aspects of security areas are important. This position is questionable; however, two different sets of criteria importance (noted E1a and E1b, where E1a labels higher education situation and E1b--secondary school case) were added to analyze in further steps. All experts filled the provided survey form, where each criterion was compared pair-wise. Based on the calculation, the criteria importance coefficients were calculated. Close to the calculated criteria importance coefficients (see Table 1 in Appendix A), the consistency ratio (CR) values were calculated to evaluate the experts' opinion consistency within the pair-wise comparison (see Table 5). The CR value lower than 0.10 is usually assumed as consistent. While higher values indicate some mismatch in experts pair-wise comparison. The analysis of CR values indicated the expert E1 has a very inconsistent opinion, especially in the case of higher education institutions (average value is 0.15, while standard deviation is 0.35). Meanwhile, the rest three experts' CR values with 95% confidentiality do not reach a CR value greater than 0.11 (average CR value plus 2 standard deviation values). Despite the fact that the expert's E1 opinions are not as consistent as the opinions of other experts, the correlation between criteria coefficients is high between each pair of experts (see Table 6). There is some difference between expert E1 and other experts, while between all experts the correlation is significant (the lowest \(p\) value is equal to 0.000455). The correlation between E2 and E4 is especially high; however, it can be influenced by the fact those two experts work in the same company while all other experts work in different companies. Therefore, some collaboration or transparent experience in the company might influence the high correlation of these two opinions. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline  & **E1a** & **E1b** & **E2** & **E3** & **E4** \\ \hline E1a & 1.000 & 0.771 & 0.522 & 0.479 & 0.463 \\ E1b & & 1.000 & 0.499 & 0.418 & 0.514 \\ E2 & & & 1.000 & 0.838 & 0.967 \\ E3 & & & & 1.000 & 0.802 \\ E4 & & & & 1.000 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Pearson’s correlation coefficients between each experts’ calculated criteria importance values.