A formal, mathematics oriented method for identifying security risks in information systems

IT security presently lacks the benefits of physics where certain unifying grand principles can be applied. The aim of the method is to provide a technology independent method of identifying components of a system in general, and of information systems in particular. The need for the proposed method is derived from ad hoc character of theories used in the present formal security textbooks. None of these can give the user any guarantee of completeness. The new method is scientifically derived as a method, presented, explained and applied to several interesting topics in the field of health care information systems. Some simple mathematical formulae can be introduced.