Using the Fuzzy FMEA Method Risk Analysis in Information Security

The rapid development of the Internet and information technologies increases the dependence of organizations on information systems in their business processes, making them more vulnerable to information technology threats. In light of these circumstances, it is imperative for organisations to proactively manage information security risks and ensure business continuity by maintaining a reliable and trustworthy corporate image. In order to identify and prevent risks in information security, this paper presents the Failure Mode and Effect Analysis (FMEA) method with a fuzzy approach. Fuzzy FMEA is preferred as a more practical and flexible risk assessment method than classical FMEA. The aim of the study is to identify the risks that may arise in the confidentiality, integrity and accessibility elements of information security in portable media and devices in an organization and to provide solutions to prevent or mitigate these risks. The study was conducted with a team of 7 experts in the field of information security. While determining the failure modes, the precautionary items under the heading 'Portable Device and Media Security' in the Information and Communication Security Guide prepared by the Digital Transformation Office of the Presidency of the Republic of Turkey were utilized and 21 failure modes were determined. The probability, severity and detectability parameters of the error modes were evaluated by experts on 10 different linguistic scales. In order to eliminate outliers, calculations were made on the median. Classical and Fuzzy FMEA were compared and it was concluded that there is a strong agreement between the two methods, but Fuzzy FMEA is more flexible and practical.