Abstract
One of the main stages of design and construction of information system resources protection is the process of risks assessment. To implement it, there is a wide range of risk analysis and assessment (RAA) tools. For their suitable choice it has been carried out a research of the corresponding tools with the objective to determine the set of necessary comparative characteristics. According to the specified means, taking into account the known analytical-synthetic tuple model of risk characteristics, the necessary tuple is being formed. It provides the way concerning the certain parameters not only to unify the process of the comparative analysis of RAA tools, but also to approach to their development. Each tuple is formed according to certain principles. The analytical tuple is formed according to the results of the analysis of existing analysis tools and risk assessment, synthetic – is formed based on experts' priorities regarding risk characteristics, which, in their opinion, should be used in the risk assessment system which is in the process of development. This would enhance the efficiency of decision making when choosing the necessary RAA tool.