Risk Cube, Essay Example

Overview

In voting situations there is a type of machine that utilizes mechanical or electrical means of directly recording the responses of the participant.  These machines are called direct-recording voting machines or DRE voting machines.  This machine is allows for faster and presumably more accurate voting results while also allowing disparate areas to participate in a centralized voting procedure.  This machine facilitates the speed and accuracy by leveraging technological advances to count and report out the results of the vote.  This also allows the ability to remain anonymous since each vote is recorded anonymously.  The DRE voting systems also allow real time feedback regarding voter intent and potential under or over voting scenarios.  This allows a proactive approach to potential voter fraud.  With any good system that incorporates technological leverage to achieve an objective there is always the potential for risk of negative ramifications.  In regard to security, the issues lie mainly in measuring the amount of security needed as well as assigning a risk classification for the DRE voting machine.  In order to gain an understanding of the security risks involved we can use a risk cube.

Overview

Risk cubes are used to assess risk by categorizing the risks by the issue, probability and impact or consequence.  With these three areas placement on the risk cube can be assigned.  It is also important to understand that when identifying risks that there is a known understanding between risks and issues.  Risks are potential events that are yet to happen and issues are current problems with impending consequences.  We will use the risk cube to assess the risk and then develop a risk mitigation plan to potentially avoid the downfalls or consequences of the risks (Cosmides and Tooby 1996).

Risks

Risks are broken down into sub-cubes with likelihood or probability of occurrence and consequence.  Likelihood and consequence is rated on a 1 to 5 scale with each area colored to distinguish between high (red), medium (yellow) and low (green) impact.  Below is a visual of what a sample risk cube would look like.

When focusing on the DRE voting machines there are multiple areas that have a potential probability of something negative happening to disrupt or disable the voting process.  This could occur in the voting process itself, the IT infrastructure (hardware or software) or through malicious intent.  The results of the voting machines are dependent upon the validity and integrity of the information processed through the software of the voting system (Feldman, Halderman, and Felten 2006).  For security there could be multiple risks such as, viruses installed by the software creator, standard operating procedures for use and implementation of the software, lack of authentication for users and administrators, inadequate or poor software development or system administrator errors.

For each of these areas there needs to be a classification regarding probability of the occurrence as well as the consequence of the issue arising.  These areas broken down are:

Conclusion

The conclusion is that the DRE voting machine is a great step forward in the voting process but there is also the inherent risk or threat to the systems security.  While these areas of concern that were addressed in the risk cube analysis may not be all encompassing of all the analysis conducted on the DRE voting machine security threats it is a good barometer of risk.  The concurrency of risk of this and the rest of the peers assessing this system should be in line with the types of risks involved but may differ in the analysis of the likelihood and consequences.  This difference could be generated from the differing backgrounds and experiences those analyzing the situation have coming into the situation.

References

Cosmides, L., and Tooby, J. (1996) Are humans good intuitive statisticians after all? Rethinking some conclusions from the literature on judgment under uncertainty. Cognition 58.

Feldman, A., Halderman, J., Felten, E., (2006) Security analysis of the diebold accuvote-ts voting machine. Princeton University. Information Technology Policy.  Retrieved from http://citpsite.s3-website-us-east-1.amazonaws.com/oldsite-htdocs/voting/.

Kahneman, D., and Tversky, A., (1979) Prospect theory: An analysis of decision under risk. Econometrica 46(2).

Nobel, (2002) “The Bank of Sweden Prize in Economic Sciences in memory of Alfred Nobel 2002,” Retrieved from http://nobelprize.org/economics/laureates/2002/index.html.

Schwarz, N. (1990) Assessing frequency reports of mundane behaviors: Contributions of cognitive psychology to questionnaire construction. Review of Personality and Social Psychology 11.

Tversky, A., and Kahneman, D., (1992). Advances in prospect theory: Cumulative representation of uncertainty. Journal of Risk and Uncertainty, 5.