Multiple-criteria decision analysis (MCDA) is a constantly developing tool that allows for a quick assessment of the quality of solution options, also in the case when the assessment criteria are difficult to measure. Therefore, they are used in more and more fields. One of them is broadly understood security. The paper describes the specificity of the assessment of issues related to safety and solved with the use of MCDA methods. At the same time, the focus was on two areas of security. The first is Occupational Health and Safety, and in particular the issue of risk assessment of workplaces, the second is Data Security. The issues related to risk assessment in the workplace are traditionally examined mainly using the FMEA method. The problem is that the values that need to be entered into this method are usually only determined on the basis of expert knowledge. In complex systems this is a difficult task and often causes important cases to be missed. MCDA methods allow for an analytical approach to the problem of finding critical cases and facilitate their assessment. Data security is an increasingly important topic in today's world. It ceases to be the domain of information protection only, but due to the fact that the "Internet of Things" is developing more and more, it also affects direct physical security. MCDA methods help in assessing the security of data in systems and in identifying gaps and weaknesses. The paper presents methods that can be used in these cases and examples of their application.
Security is one of the key issues in the relevant world. Therefore, there is a need for continuous development of methods to improve it. Occupational Health and Safety is a place where law is still needed. Although there has been a decline in the number of accidents at work in Poland for several years, there is still room for improvement. In particular, the number of serious accidents remains relatively high, including fatal accidents. Another place where you should focus on improving security is data protection. There are two things in this area. One of the sequences that increment in terms of draft conformance that conforms to the policy. It improves to the resource requirements needed for error checking. The second problem is that organizations often miss out on security threats. Responsibility for its provision results from employees with a purely technical and IT education, who focus only on the technical aspect of security, ignoring aspects related to management or work organization. It should be remembered that in smaller organizations, the main users of these methods will often be people specializing in other issues in the enterprise, and dealing with issues related to security for a small part of their time. As a result, the methods used in these issues must be easy to use. This is one of the reasons why the Risc Score method is a major tool in this field. Therefore, the authors decided to use it as one of the foundations for the creation of a combined method, allowing for a better safety assessment. It was decided to try to eliminate one of the key limitations of this method, which is local operation. When an element of the system, such as a workplace, for example, is analyzed with the Risc Score method, the analysis is purely local. This means that if the causes of problems to some extent lie outside a given element of the system, then in the case of these problems their real causes are not analyzed, but only local symptoms, and only an attempt is made to combat them. As a result, funds for improving the situation are not applied optimally, wasting them through applications not in the place of problems, but in every place where the effects of these problems occur, which in the case of complex networks of dependencies may cause that we have to spend much more on minimizing the effects, or accept that some places are not properly secured. However, there are methods that allow the identification of the real places where problems arise. One such method is Decision Making Trial and Evaluation Laboratory (DEMATEL). It allows you to assess which system components are causing the problems and where the problems are mainly caused by external influences. Therefore, the authors propose to use the combined Risk Score and DEMATEL methods in order to more effectively deter-mine where in the system measures should be applied to more effectively improve safety.
This article uses two basic methods from the Multiple-criteria decision analysis (MCDA) category. MCDA methods are heuristic methods that focus on prioritizing given events or criteria according to several keys that are difficult to define or com-pare using quantitative methods 2.1.
This method, developed by William Fin in 1971, is a qualitative method of risk assessment in the workplace. It consists in selecting potential hazardous events and then assigning them contractual values in three categories: probability of occurrence, exposure and potential consequences. The values are within the same range, most often it is from 1 to 10, and they increase with increasing risk. Their product determines the risk index (Table 1). Events are segregated according to the risk index, from the highest, which means the event that potentially causes the most severe consequences, to the event with the lowest value, which means the event that has the lowest potential for serious consequences.
A common procedure is to define an arbitrary limit of the risk indicator below which we treat given events as harmless. In this case, we try to reduce the values of probability, exposure and effects by means of remedial measures, reducing the value of the risk indicator until the result is below the limit we set. This relatively simple method is now an essential tool in workplace safety research. Its main limitation is that it does not refer to the causes of events in any way, focusing on their effects. What's more, in its typical application, each workplace is tested separately, and re-medial measures are also introduced individually. This creates the problem that only if the cause of an incident is in the same position as its effect can the remedial measures be influenced. Otherwise, we are only influencing the local symptoms of an event that actually happened elsewhere. This results in unnecessary duplication of efforts if an event causes more than one effect in different positions, reduces the effectiveness of remedial measures because they are a reaction to an event occurring elsewhere in the system than are used.
A method developed by Emilio Fontel and André Gabus. It was created for the purpose of determining the cause and effect relationships between global and regional economic, social and economic problems. It also turned out to be useful in the study and analysis of many aspects of various practical tasks in such areas as: Product and service shaping, enterprise management, information and knowledge, projects, hu-man resources and technology, marketing, construction and environmental engineering, renovation and municipal management, and economy real estate, transport and logistics, energy and public safety, education, information systems, medicine, innovation support, finance, banking and insurance.
The DEMATEL method consists in creating a total impact matrix that defines the influence of the examined elements on each other and the cause-effect character of this influence. For this purpose, a matrix of direct relationships is initially created. It consists in determining to what extent each two elements influence each other, assuming that the element has no influence on itself (formula 1).
0
12 13 ⋯ 1
21 0 23 ⋯ 2
31 32 0 ⋯ 3 (
⋮ ⋮ ⋮ ⋱ ⋮ ( 1 2 3 ⋯ 0 )
The strength of connections between the elements is defined on an arbitrary scale, usually from 0 - no influence, 1 - little influence, up to 4 very strong influence. Then we transform this matrix into the matrix of indirect connections and further into the matrix of total connections T by appropriate for the method of operation (Mirosław Dytczak, Grzegorz Ginda 2015). Based on this matrix, we determine the S + and Sindices for each element using appropriate row and column sums. The S + indicator, also denoted as D + R, is called prominence. It determines the strength of an element's interaction with other elements. The S- indicator, also known as D-R, is called a relation. It defines the nature of the influence of this element, for S-> 0 it is the causal character, and for S- <0 it is the effect character.
The DEMATEL method is often used in conjunction with other MCDA methods, such as AHP or TOPSIS. In many places, research is being carried out on the most effective combinations for various applications, including the use in safety research [Ahmed, S.K, Kabir, G 2020] [Li F 2019]
As you can see the DEMATEL method has interesting possibilities of complex analysis. Thanks to it, we can try to determine which of the events are causes and which are effects. This gives a unique opportunity to implement remedial measures where problems arise, and not where the effect is only visible.
Risk determination in the workplace has a long history of using MCDA methods. The Risk Score method is deeply rooted in this field and is today the basic research tool. The problem today is that due to its popularity, there is little interest in other methods outside the scientific world. This is mainly due to the fact that most of the other proposals use entirely new methods. This causes that people who prepare such assessments are afraid to use something that is foreign to them, and what seems unchecked to them. It should be remembered that in most enterprises, for people dealing with health and safety in the plant, it is a secondary function compared to other duties, or they are people hired from outside. As a result, the new method of safety assessment in this field must be both relatively easy to carry out and must use data that is relatively easy to obtain by means of simple questions to employees. Hence the authors' proposal that he should use the combination of the Risk Score method, which is well known with the DEMATEL method, for which the data is easy to obtain by means of simple questions ("how do you assess to what extent the work of position X affects the work of your position"), and the computational part of which is it can be easily implemented in a worksheet such as "EXEL". Thanks to this, the new method does not require new skills from the assessor, and there are no problems with the analysis of the results, as it is analogous to the Risk Score. 3.2.
The main problem in today's approach to data security analysis is the fact that most institutions focus only on the technical aspect of data security. This is due to several reasons. The first is that it is customary in many organizations that IT employees are responsible for data security. Therefore, the first step in securing data for them is to assess the technical aspect of data security. Meanwhile, experience shows that most of the incidents which resulted in serious data leaks have non-technical reasons. As a result, purely technical security measures are not fully effective. Another problem with technical security measures is that their operation reduces the efficiency of access to data by authorized users. Therefore, it is necessary to take a more general look at data security analysis. This has already been recognized by the institutions most dependent on data security, such as banks and defense institutions. However, the actions taken by them are mainly based on the knowledge and intuition of people responsible for security, and not on systematic research. The reason for this is the lack of appropriate simple test methods to compare the technical issues with those related to the personal aspect of data protection. The methods from the MCDA group seem to be the answer to this problem, due to their flexibility and ease of use. The Risc Score and DEMATEL methods in particular seem to fit the problem. In the case of the Risc Score method, its main advantage is that it is a method known in every organization due to its application in job research. This means that there are already people trained in using it in each organization. Meanwhile, the DEMATEL method brings a unique opportunity to assess what is the cause and what the effect in a chain of events that may lead to a data leak. It can include events related to the technical aspect of data security as well as to the "human factor". At the same time, the computational part of the method is easy to implement in a typical spreadsheet, which reduces the requirements for the person who carries out the test. Also, the fact that the majority of data storage installations today has a network structure predisposes this method, because it has been successfully used many times in the safety assessment of installations such as electrical networks [Li P 2019], supply lines or pipelines.
After this modification, the risk value reflects not only the severity of the consequences of an event at a given position, but also the impact of the event on the emergence of other hazardous situations. Thanks to this, if we are guided in the allocation of funds for improving the situation by the ranking of the risk indicator, then in the first place the funds are allocated to events that not only have serious effects in a given location, as it was in the pure Risk Score analysis, but also those that cause other events in other locations. Thanks to this, if we manage to reduce the risk of events with a high rate, the risk of some events with lower rates that are directly or indirectly related to each other also reduces. As a result, the resources that we spend on improving the situation have a greater impact on the overall security in the organization.
The authors' proposal is to use a method combining the Risk Score and DEMATEL methods in the field of safety research. The aim is to use the potential of the well-known and widely used Risk Score method, while introducing the possibility of a systemic approach and conducting activities at the source of problems. Such possibilities are provided by the DEMATEL method. For this purpose, we introduce two further indicators to the Risk Score method, derived from the results of the DEMATEL method. The first is the transformed S + index and the second is the transformed S- index. The transformation consists in bringing the values of these indicators to the same range of values as the other indicators in the Risk Score method, i.e. most often to the range (0.10>. This can be easily done using the min-max normalization (formula 2)
−
∗ = − ∗ (
When this is applied, a modified table is produced (Table 2).
PE1 PE2 PE3 PE4 S*+ S*+1 S*+2 S*+3 S*+4 S*S*-1 S*-2 S*-3 S*-4
P1*E1*PE1* S*+1* S*-1 P2*E2*PE2* S*+2* S*-2 P3*E3*PE3* S*+3* S*-3 P4*E4*PE4* S*+4* S*-4 5. Conclusions
they do not have an accessible set of tools to solve them. It is particularly visible in the activities of smaller organizations that are not able to maintain specialized departments dealing with security that employ specialists. This causes various negative phenomena. In terms of health and safety, the main problem is that only the Risk Score method is used, regardless of its limitations. This results in a phenomenon in which health and safety problems are solved only by introducing protection against accidents, without going into what is the real reason for their occurrence. This re-duces both their effectiveness and results in ineffective spending of funds on im-proving the situation. A similar phenomenon can be observed in the field of data security. Here, it is partly due to the narrow view of people dealing with this subject, resulting from the fact that most of them deal only with the technical aspect of data security, and the fact that there are no easy and widely known methods of assessing this security in its entirety. The authors believe that the answer to this problem may be the MCDA methods, in particular the Risk Score method combined with the DEMATEL method. This is possible thanks to the relatively good knowledge of the Risk Score method in the environment of people responsible for risk assessment in the workplace, the ease of obtaining data needed for the analysis and the relative simplicity, combined with the possibility of implementing the method using soft-ware available in most offices. Therefore, the authors believe that there is room for further research here.