Assessing Information Security Risk Management in Organizations

Mohamed M. El Hadi

doi:10.12816/0014066

Article Details

Assessing Information Security Risk Management in Organizations

Authors:

Mohamed M. El Hadi

Publisher:

Egyptian Society for Information Systems and Computer Technology

Main Topics:

Technology

Journal:

Compunet ( The Egyptian Information Journal ) 2014 Vol.13 Issue 14, pp.18-32

Document Type:

Article

Publication Date:

4/2014

Document Language:

English

Document ID (Org No.):

69230

Frequency:

Quarterly

pISSN:

23569697

DOI:

10.12816/0014066

Descriptors:

Keywords:

Abstract:

 Information security risks are those risks that arise from the loss of confi- dentiality, integrity or availability of in- formation or information systems and reflect the potential adverse impacts to organizational operations (i.e., goal, mission, functions, image and reputa- tion), organizational assets, personnel, other organizations, and the country as a whole. Risk assessment is the process of identifying, estimating, and prioritizing information security risks. Assessing risk requires the useful analysis of threat and vulnerabilities information to determine the extent to which events or circumstances could adversely impact on organization/institution and the likelihood that such events or circumstances will occur.
This technical paper describes the fundamental concepts and processes related with assessing information security risk management within organizations/institutions including: (1) a high level overview of the risk management process and risk assessment, (2) the basic concepts used in conducting risk assessments, and (3) how risk assessments can be applied across the organization's risk management three hierarchical Tiers including Tier 1 and Tier 3 of the information systems within any organization. Therefore, this work identifies and explains the main themes regarding risk assessments in organizations: Risk management process and
its main four components regarding assessing, framing, monitoring and responding; Risk assessment as the main component that addresses the potential adverse impacts on organizational operations, assets, etc.; Key risk assessment concepts that indicate risk models (threats, vulnerabilities and predisposing conditions, etc.), assessment approaches concerned with quantitative and semi-quantitative assessments as well as qualitative assessment, and analysis approaches and effects of organizational culture on risk assessment; Applications of risk assessments through the main three risk assessments hierarchy's Tiers; Risk management process with its main four steps or operations as well as the risk management framework; Finally the administrative, proce4dural and technical controls conforming the policy and controlling the risks.

Article Details

Assessing Information Security Risk Management in Organizations

Authors:

Mohamed M. El Hadi

Publisher:

Egyptian Society for Information Systems and Computer Technology

Main Topics:

Technology

Journal:

Compunet ( The Egyptian Information Journal ) 2014 Vol.13 Issue 14, pp.18-32

Document Type:

Article

Publication Date:

4/2014

Document Language:

English

Document ID (Org No.):

69230

Frequency:

Quarterly

pISSN:

23569697

DOI:

10.12816/0014066

Descriptors:

RISK MANAGEMENT

INFORMATION

COMPUTER SECURITY

INFORMATION SYSTEMS

ORGANIZATIONS

Information Security

Risk Assessment

Risk Analysis

Risk Management Process

Risk Management Framework

Risk Models

Threats

Vulnerabilities

Predisposing Conditions

Issues

Article Details

Authors: Mohamed M. El Hadi

Publisher: Egyptian Society for Information Systems and Computer Technology

Main Topics: Technology

Journal: Compunet ( The Egyptian Information Journal ) 2014 Vol.13 Issue 14, pp.18-32

Document Type: Article

Publication Date: 4/2014

Document Language: English

Document ID (Org No.): 69230

Frequency: Quarterly

pISSN: 23569697

DOI: 10.12816/0014066

Descriptors:

Issues

Authors:

Mohamed M. El Hadi

Publisher:

Egyptian Society for Information Systems and Computer Technology

Main Topics:

Technology

Journal:

Compunet ( The Egyptian Information Journal ) 2014 Vol.13 Issue 14, pp.18-32

Document Type:

Article

Publication Date:

4/2014

Document Language:

English

Document ID (Org No.):

69230

Frequency:

Quarterly

pISSN:

23569697

DOI:

10.12816/0014066