An Analytical Study of Methodologies and Tools for Enterprise Information Security Risk Management

Abstract

An enterprise is characterized by its business processes and supporting ICT infrastructure. Securing these entities is of utmost importance for the survival of an enterprise and continuity of its business operations. In order to secure them, it is important to first detect the risks that can be realized to cause harm to those entities. Over the years, several kinds of security risk analysis methodologies have been proposed. They cater to different categories of enterprise entities and consider varying levels of detail during risk analysis. An enterprise often finds it difficult to select a particular method that will best suit its purpose. This paper attempts to address this problem by presenting a detailed study of existing risk analysis methodologies. The study classifies them into specific categories and performs comparative analyses considering different parameters addressed by the methodologies, including asset type, vulnerabilities, threats, and security controls.

Intelligent Risk Management framework

“…IoT refers to the ubiquitous network of everyday objects embedded with computing devices. It merges different technologies, standards and services in order to support intelligent decision making [1]. IoT is the key to delivering smart services, as for environment monitoring, devices tracking, smart buildings and trafficc optimization [2].…”