Title: Security risk assessment: toward a comprehensive practical risk management

Authors: Danilo Valeros Bernardo

Addresses: i-Next, FEIT, The University of Technology Sydney, P.O. Box 123, Broadway, Sydney, NSW, Australia

Abstract: This paper introduces a unique approach to a more integrated security risk assessment (SRA). This is formalised based on the proven mathematical methods described in various articles in the literature and combined with the work developed by the author. Whilst the widely used qualitative frameworks were introduced by existing international standards, the approach presented in this paper provides a novel way of better managing security risks in organisations. It uses a combination of qualitative and ranking methods based on a distance-based approach. The successful implementation of this approach in one of the world's largest financial institutions provided an alternative and unconventional means of performing more practical integrated security risk management, in a manner consistent with the current set of standards and practices. The method used in this paper is more effective than the existing single-faceted methods available. It gauges the significance of each risk by ranking them and providing preferences based on users' perspectives. These are qualified and quantified to achieve more comprehensive and effective risk assessment results.

Keywords: security risks; risk assessment; distance-based methods; ranking methods; ISO 27001; AS/NZS 4360; risk management; international standards; financial institutions; preference ranking; user perspectives.

DOI: 10.1504/IJICS.2012.051775

International Journal of Information and Computer Security, 2012 Vol.5 No.2, pp.77 - 104

Published online: 30 Aug 2014 *

Full-text access for editors Access for subscribers Purchase this article Comment on this article