## 4 Evaluation Technique of Database Security
In order for the assessment of the value of assets to make economic sense, it is advisable to correlate the qualitative scale of assessing the damage with the amount of direct financial losses. However, establishing such a correspondence requires additional research in each specific case and depends on many factors for the systems under consideration. Possible independent scales (examples) for assessing direct financial losses and their relative values (\(r^{rel}_{fl}=z_{fl}/z^{per}_{fl}\), where \(z_{fl}\) is direct financial losses; \(z^{per}_{fl}\) is permissible direct financial losses) are shown in Table 2. At that, it should be understood that, depending on the tasks solved by the organization, the area, the nature and scale of its activities, the form of ownership, the value of assets, the severity of the consequences of violating their security and a number of other factors, they may be other. \begin{table}
\begin{tabular}{c c c} \hline _Level_ & \(\mathbf{T_{L}}\) & _Semantic Characteristic_ \\ \hline
1 & Very low & Loss can be ignored. \\
2 & Low & The damage can be easily eliminated; the costs of eliminating the consequences of the threat implementation are low. \\
3 & Medium & Eliminating consequences of the threat implementation is not associated with large costs. \\
4 & High & Eliminating consequences of the threat implementation is associated with significant financial losses. \\
5 & Very high & The organization ceases to exist. \\ \hline \end{tabular}
\end{table} 
Table 1: The assessment of damage and its semantic characteristic. \begin{table}
\begin{tabular}{c c c c} \hline _Level_ & \(\mathbf{T_{L}}\) & _Range_\(\mathbf{z_{fl}}\) & _Range_\(\mathbf{r^{rel}_{fl}}\) \\ \hline
1 & Very low & \textless{}100 \$ & \textless{}0.1 \\
2 & Low & (100–1000) \$ & (0.1, 0.3] \\
3 & Medium & (1000–10,000) \$ & (0.3, 0.6] \\
4 & High & (10,000–100,000) \$ & (0.6, 0.9] \\
5 & Very high & \textgreater{}100,000 \$ & \textgreater{}0.9 \\ \hline \end{tabular}
\end{table} 
Table 2: Financial damage assessment scales. Figure 5: Graphs of the membership function of fuzzy sets \(A^{L}_{\text{VH}}\), \(A^{L}_{\text{H}}\), \(A^{L}_{\text{M}}\), \(A^{L}_{\text{L}}\), \(A^{L}_{\text{VL}}\). Thus, when developing an evaluation technique of database security, the authors, based on a generalization of experts' recommendations, determined the number of levels for the linguistic variables under consideration with their corresponding ranges, as well as the membership functions and a variant of determining the numerical value for the corresponding likelihood or damage. Having the appropriate data using Equation (4), it is possible to determine the security value of the analyzed database. It should be noted that the proposed technique, in contrast to some known, is characterized by a certain flexibility. This is manifested in the ability to adapt to new conditions of functioning and to take into account the emerging new actual threats, vulnerabilities, security measures that can be combined into some general groups. Including there is the possibility of choosing the number of levels of the corresponding linguistic variables. At that, the use of the introduced integral security metric makes it possible to evaluate the security value of the investigated RDB quantitatively.