Information Security Risk Management: An Intelligence-Driven Approach

Abstract

Three deficiencies exist in the organisational practice of information security risk management: risk assessments are commonly perfunctory, security risks are estimated without investigation; risk is assessed on an occasional (as opposed to continuous) basis. These tendencies indicate that important data is being missed and that the situation awareness of decision-makers in many organisations is currently inadequate. This research-in-progress paper uses Endsley's situation awareness theory, and examines how the structure and functions of the US national security intelligence enterprise-a revelatory case of enterprise situation awareness development in security and risk management-correspond with Endsley's theoretical model, and how facets of the US enterprise might be adapted to improve situation awareness in the information security risk management process of organisations.

Problems in information classification: insights from practice

“…If the information classification is not considered a critical activity, it can lead to problems with the risk assessment. If there are shortcomings with the classification, it will reduce the possibility of adequately protecting the organizational assets as less knowledge is available, leading to less informed decisions (Shedden et al , 2016; Webb et al , 2014). Further, it also means that assets that should have been identified will remain unidentified.…”

“…ISO 27002:2017 (ISO Central Secretary, 2017) describes its objective as an activity that is necessary to ensure that information receives an appropriate level of protection in accordance with its importance to the organization . Once the classification of assets is set, the result act as input into the risk assessment where classified information is required to analyze, prioritize and manage risks and apply protection (Bergström and Åhlfeldt, 2014; Everett, 2011; Webb et al , 2014). Thus, it is an essential piece of risk analysis and management within organizations (Bergquist et al , 2021; Everett, 2011; Gerber and Von Solms, 2005).…”

“…Identifying and classifying information is not straightforward, and problems occur (Bergström and Åhlfeldt, 2014), leading to failures of the risk assessment and risk management activities if not accomplished (Shedden et al , 2016; Webb et al , 2014). Guidelines and standards, e.g.…”

Strategic value alignment for information security management: a critical success factor analysis

“…Current studies on ISM focus on the conceptual understanding of ISM, the performance evaluation of ISM and the factors that affect the success of ISM. A few papers have provided conceptual view of ISM at the organizational level from different perspectives: as an integrated component in corporate governance (Johnston and Hale, 2009;Posthumus and von Solms, 2004;Tsohou et al, 2015;von Solms and von Solms, 2006), as a form of risk management (Chang et al, 2011;Dhillon and Backhouse, 2001;Webb et al, 2014) and as a life cycle of dynamic multiple-phase decision-making (Ma et al, 2009;Nazareth and Choi, 2015;Nyanchama, 2005;Pipkin, 2000). A group of researchers has called for investigating the quality of information security programs (Choobineh et al, 2007).…”

Information Security Risk Management for BIDUK System

“…Information become vital part of organization. Almost everything in daily works involves the use of information [1]. Non-profit organization, such as Archdiocese of Jakarta is no exception.…”