Assessing security risks in the IT infrastructure of sensitive organizations using the fuzzy AHP technique and validation with fuzzy Cocos in a knowledge-based medical equipment company

Information technology (IT) infrastructures in knowledge-based medical device companies are among the most sensitive and critical organizations because they host critical health data, source codes of diagnostic systems, and intellectual property of smart products. Risk assessment in these dynamic environments requires robust models of multi-criteria decision-making that can cover the uncertainty and ambiguity of experts’ words. The aim of this study is to assess, prioritize, and validate the security risks of IT infrastructure in a leading knowledge-based company in the production of operating room equipment. In this regard, first, by reviewing the literature and surveying ۱۰ security and IT experts, key risks were identified in the form of ۴ main criteria and ۱۲ sub-criteria. Then, using Chang’s developmental analysis technique in the fuzzy analytic hierarchy process (FAHP) method, the weights of the main criteria and sub-criteria were calculated. In the next step, the emerging Fuzzy CoCoSo technique was used to rank organizational units based on vulnerability and validate the model. The weighting results showed that “software and operating system risks” with a weight of ۰.۳۸۲ have the highest importance. Also, validation using the Fuzzy CoCoSo method determined that the Research and Development (R&D) unit with a final index of ۰.۸۵۴ is the most vulnerable and risky part of the organization in facing cyber risks.

کلیدواژه ها:

Risk assessment ، IT security ، medical equipment ، Fuzzy AHP ، Fuzzy CoCoSo ، Multi-criteria decision making.