Abstract. Risk is an inherent part of the functioning of every organization therefore the risk management should be a natural activity at each level of management. A common mistake in the management process of an organization is separating the security system, including the risk management system, and treating it as an isolated element. The article presents the place and role of the risk management system in the context of safety of the IT resource of an organization. A model of the risk management system was developed as the basic element of the organization management system and function supporting the continued operation in terms of IT safety of modern organizations.

No abstract

Abstract. The article discusses the problem of risk management in the context of safety of an organization's information assets. Assuming system of information risk management as a basic element of organization management in the aspect of information safety of modern organizations, this document focuses on methods and techniques of qualitative risk estimates. Basic standards and good practice from areas of risk management and ensuring information safety in the organization were recalled.

No abstract

The article addresses the issue of efficiency assessment of the security system (SS) in terms of the Information Security Management System (information resources of the information system in an organization). It is assumed that the purpose of such security system is to achieve a declared level of protection of the information system resources. Therefore, the level of security of information system in a given organization shall be determined by the efficiency assessment of the security system. The efficiency of the security system mainly depends on the functional properties of its components and other factors occurring in its environment. The article mainly focuses on security configuration, i.e. technical configuration and security organization configuration. The thesis was adopted that the efficiency of the security system may be considered as a set-theoretic efficiency sum of the security configurations invoked in such system. Additionally, it was assumed that a prerequisite for the desired measures (indicators) of the efficiency assessment of the SS shall be to propose such measures and develop appropriate ways (methods) of their calculation. The efficiency measure for the SS as well as two methods of efficiency assessment of the SS were proposed in the article.