"A risk assessment of the Piql Services" by FFI
The first step in the analysis phase is to concisely define the problem. From there the dimensions, or parameters , that best characterise the problem are identified. The last step in the analysis phase is to assign a range of relevant conditions, or values , for each parameter. It is important to ensure that the values are mutually exclusive and exhaustive for the given parameter, insofar as that is possible. Together, the parameters and corresponding values make up the morphological space, shown in table 6.1 as an example of a morphological matrix.
Parameter A
Parameter B
Parameter C
Parameter D
Parameter E
Value A1
Value B1
Value C1
Value D1
Value E1
Value A2
Value B2
Value C2
Value D2
Value E2
Value B3
Value C3
Value E3
Value B4
Table 6.1 Example of a morphological matrix
The next steps belong to the synthesis phase. First, one does an internal consistency analysis of the morphological matrix. The matrix shown in the example here consists of 2 x 4 x 3 x 2 x 3 = 144 theoretically possible combinations. This number is too vast to comprehend from an analytical point of view, and, additionally, not all of the combinations, or pairings, are plausible. It is the purpose of the internal consistency analysis to weed out these implausible parings. One compares the values to one another, one by one, asking the question: if A1, is B1, B2, C1 and so on possible? Internally consistent pairings of the values , meaning pairs that would be possible in the real world, are thus identified and fed into a consistency matrix giving you the total range of possible solutions existing in you morphological space. This is called the solution space for your given problem. From there you feed the results of the consistency analysis into an IT tool, which defines all scenarios which find consistent solutions on all parameters , i.e. a scenario which could exist in the real world. The resulting list of scenarios is called the outcome matrix. Finally, evaluating the scenarios using common sense, you see if any are similar enough to comprise a scenario class. The result is a final number of scenario classes from which you make specific scenario descriptions. 17 As a tool in this final process, FFI has developed a scenario template adapted to the PreservIA project, enabling us to more easily describe a larger number of scenarios. The template is presented in chapter 7. Morphological analysis was chosen in this project because it a method to structure and analyse complex problems, and the purpose of the assessment in this report is indeed a complex problem. We found, however, that while the method was suitable to identify issues related to security, it was less helpful with issues of safety. The same difficulty arose when FFI researcher Sunniva Meyer undertook a task of similar, if not higher, complexity: to map all threats to the security of an entire nation [43]. She reflected that because the sample space of such a complex
17 All the steps of the morphological box are defined in [39 p.9]
51
FFI-RAPPORT 16/00707
Made with FlippingBook Online newsletter