RISKEE: A Risk-Tree Based Method for Assessing Risk in Cyber Security

Michael Krisper*, Jürgen Dobaj, Georg Macher, Christoph Schmittner

*Corresponding author for this work

Research output: Chapter in Book/Report/Conference proceedingConference paperpeer-review


In this paper, the RISKEE method for evaluating risk in cyber security is described. RISKEE is based on attack graphs and the Diamond model combined with the FAIR method for assessing and calculating risk. It can be used to determine the risks of cyber-security attacks as a basis for decision-making. It works by forwarding estimations of attack frequencies and probabilities over an attack graph, calculating the risk at impact nodes with Monte-Carlo simulation, and propagating the resulting risk backward again. The method can be applied throughout all development phases and even be refined at runtime of a system. It involves system analysts, cyber security experts as well as domain experts for judgement of the attack frequencies, system vulnerabilities, and loss magnitudes.

Original languageEnglish
Title of host publicationSystems, Software and Services Process Improvement - 26th European Conference, EuroSPI 2019, Proceedings
EditorsAlastair Walker, Rory V. O’Connor, Richard Messnarz
PublisherSpringer Verlag
Number of pages12
ISBN (Print)9783030280048
Publication statusPublished - Sept 2019
Event26th European Conference on Systems, Software and Services Process Improvement: EuroSPI 2019 - Edinburgh, United Kingdom
Duration: 18 Sept 201920 Sept 2019

Publication series

NameCommunications in Computer and Information Science
ISSN (Print)1865-0929
ISSN (Electronic)1865-0937


Conference26th European Conference on Systems, Software and Services Process Improvement
Country/TerritoryUnited Kingdom


  • Attack trees
  • Cyber physical security
  • Diamond model
  • FAIR method
  • IT-security
  • Risk assessment
  • Risk propagation

ASJC Scopus subject areas

  • Computer Science(all)
  • Mathematics(all)

Fields of Expertise

  • Information, Communication & Computing

Cite this