Risk Management

How Secure is Our Information Infrastructure?

Abstract:

Managers of critical information infrastructures need better tools for managing risk than the qualitative or compliance-based metrics commonly used today in critical infrastructure protection. This paper provides a performance-based metric that can be used to obtain a quantitative measure of the security of information infrastructures. 

Does Traditional Security Risk Assessment have a Future in Information Security?

ABSTRACT

The current information security standards still advocate the use of risk assessment in the prioritisation of security investments. However, prior research on the use of risk assessment methodologies in organisational security has shown that the use of the traditional monolithic risk assessment process described in the current risk management standard is simply not practical at the organisational level. This paper first examines the problems in performing a systematic risk assessment and then discusses the limitations of a traditional risk assessment. To address these limitations, this paper proposes splitting up the current monolithic risk assessment process. The result is an information security assessment framework that puts greater emphasis on situational awareness and allows for better decision making on the prioritization of security investments.

The Weakest Link : The ICT Supply Chain and Information Warfare

ABSTRACT

This paper proposes a unified model of best practice for ICT Supply Chain Risk Management (SCRM). Ensuring proper ICT-SCRM practice is an important national priority because of the vulnerability of current supply chains to attack by nation states and other adversaries. This paper presents a comprehensive set of standards-based lifecycle practices designed to address ICT product integrity concerns in the global marketplace.

Cybersecurity Economics: Induced Risks, Latent Costs, and Possible Controls

ABSTRACT

Financial decisions indirectly affect and are affected by the effort towards Information Security. The ‘Economics of Cybersecurity’ should thus constitute a significant part of the Information Security Posture Assessment process and should be directly addressed in this context. As the complexity and interdependency of Information Systems augments and new technologies lead to the de-materialisation of Information Systems assets, it becomes progressively evident that the conflicting interests and incentives of the various stakeholders of an Information System affect its overall Information Security Posture, perhaps even more significantly than technical or policy limitations do. This paper examines economic considerations from an Information Systems Security/Cybersecurity viewpoint and proposes new directions that may both help reduce the problem from a collective point of view, as well as lead to the creation of methodologies to ultimately integrate economics, along with technical and non-technical issues, into an Organisation’s Information Security Posture Assessment process.

Journal of Information Warfare

The definitive publication for the best and latest research and analysis on information warfare, information operations, and cyber crime. Available in traditional hard copy or online.

Keywords

Quill Logo

The definitive publication for the best and latest research and analysis on information warfare, information operations, and cyber crime. Available in traditional hard copy or online.

SUBSCRIBE NOW

Get in touch

  • Journal of Information Warfare
    114 Ballard Street
    Yorktown, VA
    23690
  • 757.234.6664
  • jiw@gbpts.com