In this paper, we introduce a framework to guide
decision makers evaluating information security policy
performance. It is motivated by lack of adequate decision
making mechanism with broader scopes and easy to use for
the decision makers. The framework, which adopts Analytic
hierarchy Process (AHP) methodology, is developed into a
four level hierarchy (goal, criteria, sub-criteria, and
alternatives) representing different aspects of information
security policy. A survey based on AHP methodology was
conducted to obtain decision maker preferences. Instead of
relying on dedicated AHP software, we prefer to clearly
demonstrate the process of AHP calculations by using Open
Office Calc in data analysis. The aims are to show the
applicability of open source software in handling AHP
decision making problem and to help decision makers in
understanding AHP data analysis procedures without
relying on proprietary software. Results show that decision
makers prefer availability of information security as highest
priority, followed by confidentiality and integrity. The
findings reflect future strategy in order to improve the
effectiveness of information security policy in the
organization.
Index Terms—information security policy, decision making,
Analytic Hierarchy Process, open source.
I. INTRODUCTION
The Analytical Hierarchy Process (AHP) is a decision
support system to deal with multi criteria decision
making (MCDM) problems developed by Saaty [1]. It
aims to quantify relative priorities for a given set of
alternatives on a ratio scale, based on decision maker
judgments, by strictly following consistency standard of
the pair wise comparison in the decision-making process.
Since a decision-maker bases judgments on knowledge
and experience, then makes decisions accordingly, the
AHP approach agrees well with the behavior of a
decision maker. The strength ofthis approach is that it
organizes tangible and intangible factors in a systematic
way, and provides a structured yet relatively simple
solution to the decision making problems [2]. In addition,
by breaking a problem down in a logical fashion from the
large, descending in gradual steps, to the smaller and
smaller, one is able to connect, through simple paired
comparison judgments, the small to the large. As a result,
AHP has been widely adopted in various areas of
research and practices these days such as government
[18], business management [19] industry [20], health
[21], education [22] and many other areas [4]. It mainly
used for making selection, evaluation, cost and benefit
analysis, resource allocations, planning and development,
priority and ranking, and forecasting [23].