Factors in the selection of a risk assessment method

Abstract

A risk assessment method is used to carry out a risk assessment for an organization’s information security. Currently, there are many risk assessment methods from which to choose, each exhibiting a variety of problems. For example, methods may take a long time to perform, may rely on subjective estimates for the security input data, may rely heavily on quantification of financial loss due to vulnerability, or may be costly to purchase and use. Discusses requirements for an ideal risk assessment method, and develops and evaluates factors to be considered in the selection method. Empirical research was carried out at two large, Australian organizations, in order to determine and validate factors. These factors should be of use to organizations in the evaluation, selection or development of a risk assessment method. Interesting conclusions are drawn about decision making in organizational information security.

Citation

Lichtenstein, S. (1996), "Factors in the selection of a risk assessment method", Information Management & Computer Security, Vol. 4 No. 4, pp. 20-25. https://doi.org/10.1108/09685229610130503