I believe it is fairly common among some of my security metrics friends to cringe at the thought of performing mathematical operations when applying a numeric scale in a risk assessment process that assigns, say, a 1 to 5 value to threats, vulns, and asset value. The common reasoning is that these are ordinal numbers and ordinal numbers can’t be multiplied (in this case).
Quick background – numbers can be used in (at least) four different ways – nominal, ordinal, interval, and ratio. As you move up this ladder, more operations are available to you. I am not a mathematician, so feel free to read the details here as I have a reasonable chance of getting some nuance incorrect (who knows, maybe even the one that I am posting about).
So I see that mathematical operations with ordinal numbers (where you rank from 1 to 5) are a bad idea, but it is not clear to me that these scales are the common usage in a risk assessment. In my experience, threats, vulns, and asset value are typically assigned a 1 to 5 value where multiple objects can have the same value — that is, they could all be given values of three.
In this case, those numbers are not ordinal, they are interval numbers or probably even ratio numbers. That is, there is some notion of scale here, and these numbers are assigned based on some notion of proportion – the difference between a 1 and a 2 actually is the same magnitude as the difference between a 4 and a 5 (with ordinal numbers, this does not have to be the case).
Any mathematicians out there who would care to comment?
Does it matter? Unless it’s a ratio scale, it’s all meaningless.
Using Interval numbers in R=TxVxA is like trying to multiply June 7th by June 3rd and saying the result is June 21st.
I think you’d have a tough time arguing that they are usually ratio. I’ve seen some try to say they are representative of some unknown ratio scale – but then they just become ordinal qualifiers for that ratio scale (which makes them useless again).
@Alex -
I don’t think your example is a legitimate comparison to the situation I am describing, and it makes me think even more that these scales are ratio and not interval.
The more I think about it, a 1 to 5 scale (or whatever) has a true zero and is probably ratio. And it definitely matters if you can perform operations on the numbers.
If it is a “true ratio” than what does “1″ stand for (and especially when you compare it to “2″)?
What are the units for any of these purportedly ratio variables?
@Alex – 2 is twice as big as 1 and half as big as 4.
@Chris – the units are points.