A General, But Readily Adaptable Model of Information System Risk

Abstract

This article is the first of two whose goal is to advance the discussion of IS risk by addressing limitations of the current IS risk literature. These limitations include: • inconsistent or unclear definitions of risk, • limited applicability of risk models, • frequent omission of the temporal nature of risk, and • lack of an easily communicated organizing framework for risk factors. This article presents a general, but broadly adaptable model of system-related risk. The companion article, CAIS Volume 14, Article 2 [Sherer and Alter, 2004] focuses on IS risk factors and how these factors can be organized. This article starts by identifying criteria for a general, but broadly applicable risk model. It compares alternative conceptualizations of risk and provides clarifications of the definitions of risk and of different treatments of goals, expectations, and baselines for assessing risk. It presents several of the risk models in the IS literature and discusses the temporal nature of risk.

What could possibly go wrong? A multi-panel Delphi study of organizational social media risk

“…When an organization fails to understand risk or lacks awareness of risk, it cannot develop effective security policies or other appropriate controls to mitigate the danger to the organization (Alter and Sherer 2004;Baskerville et al 2014). To understand how risk perceptions are formed, Goodhue and Straub (1991) developed a model of security concern based on a manager's attitudes towards the risks inherent in industry, the actions an organization can take to mitigate risk through its' IT environment, and personal expertise and work experience.…”

A security risk analysis model for information systems: Causal relationships of risk factors and vulnerability propagation analysis

“…In practice, the security risk analysis is quite complex and full of uncertainty [2]. The uncertainty, existing in the process of risk analysis, has been an important factor that influences the effectiveness of risk analysis.…”

“…A1 is developed to learn the BN structure based on reference [11]. (1) The organization develops, disseminates, and updates documented procedures to facilitate the implementation of the physical and environmental protection policy and associated physical and environmental protection controls (2) The organization monitors physical access to the information system to detect and respond to physical security incidents (3) The organization monitors real-time physical intrusion alarms and surveillance equipment (4) The organization employs automated mechanisms to recognize potential intrusions and initiate designated response actions (5) The organization maintains visitor access records to the facility where the information system resides (6) The organization employs automated mechanisms to facilitate the maintenance and review of access records (7) The organization protects power equipment and power cabling for the information system from damage and destruction (8) The organization employs redundant and parallel power cabling paths (9) The organization employs and maintains fire suppression and detection devices/systems for the information system that are supported by an independent energy source (10) The organization employs fire detection devices/systems for the information system that activate automatically and notify the organization and emergency responders in the event of a fire (11) The organization employs an automatic fire suppression capability for the information system when the facility is not staffed on a continuous basis (12) The organization protects the information system from damage resulting from water leakage by providing master shutoff valves that are accessible, working properly, and known to key personnel (13) The organization positions information system components within the facility to minimize potential damage from physical and environmental hazards and to minimize the opportunity for unauthorized access…”

“…Some comprehensive approaches combining both quantitative and qualitative methods have also been proposed [2,38]. Chen et al [9] applied the similarity measures of generalized fuzzy numbers to deal with fuzzy risk analysis problems.…”

IT project risk assessment of learning organizations by fuzzy set and systems

“…On the other hand, the nature of relationship between IT and organizational learning is an increasing concern to practitioners; hence numerous authors have developed theories and predictions methods for identifying IT project parameters. Alter and Sherer (2004) suggested that analysis of risk factors would facilitate implementation success. McFarlan (1981) suggested that IJOA 22,2 appropriate attention to risk management in the IS development life cycle would avert some common IT project fiascoes.…”