Foundations for an Intelligence-driven Information Security Risk-management System

Authors

Jeb Webb, The University of MelbourneFollow
Atif Ahmad, The University of MelbourneFollow
Sean Maynard, The University of MelbourneFollow
Graeme Shanks, The University of MelbourneFollow

Abstract

Information security risk management (ISRM) methods aim to protect organizational information infrastructure from a range of security threats by using the most effective and cost-efficient means. We reviewed the literature and found three common deficiencies in ISRM practice: 1) information security risk identification is commonly perfunctory, 2) information security risks are commonly estimated with little reference to the organization’s actual situation, and 3) information security risk assessment is commonly performed on an intermittent, non-historical basis. These deficiencies indicate that, despite implementing ISRM best-practice, organizations are likely to have inadequate situation awareness (SA) regarding their information security risk environments. This paper presents a management system design that organizations can use to support SA in their ISRM efforts.

Recommended Citation

Webb, Jeb; Ahmad, Atif; Maynard, Sean; and Shanks, Graeme (2016) "Foundations for an Intelligence-driven Information Security Risk-management System," Journal of Information Technology Theory and Application (JITTA): Vol. 17: Iss. 3, Article 3.
Available at: https://aisel.aisnet.org/jitta/vol17/iss3/3