Abstract
Decisions concerning the security of information are frequently taken on a different basis to other business decisions. Necessary investments may not take place on the grounds that the returns are not easily quantifiable, when compared with other investments, or in the blithe hope that “it will never happen to us”. Conversely, “fear, uncertainty and doubt” can lead organisations to divert funds towards information security that might be better spent elsewhere. This paper presents Structured Risk Analysis (SRA), a method to help organisations take rational steps to improve their information security. Using SRA, an organisation can place information security in the context of the business as a whole, to determine the appropriate level of resources to be directed toward improvements. Given this budget, SRA enables the organisation to identify how it should be spent to generate the best possible security ‘return’.
Whilst other risk analysis methods exist, we believe SRA to be more closely integrated with other business processes, systems development and operations, giving a much firmer context for the analysis and more confidence in the results. It is non-proprietary, does not require specialist software tools and is inherently ‘tuneable’ in the level of detail that is applied: all of which means that SRA is particularly cost-effective.
We believe SRA gives business owners the information they need to make truly informed decisions about the security, viability and future direction of their Information Systems.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
References
Rogers, James, Simons, Mike.: Revenue’s security glitch a warning for e-government, Computer Weekly Magazine, Thursday 6th June 2002.
Weaver, Philip L, Lambrou, Nicholas, Walkley, Matthew.: Practical SSADM Version 4+, Financial Times Pitman Publishing, ISBN 0-273-62675-2, 2nd Edition, 1998.
Yourdon, Inc.: Yourdon Systems Method: Model-Driven Systems Development, Prentice Hall, ASIN 013045162,: 1st edition (March 4, 1993)
Yourdon, Edward, Coad, Peter.: Object-Orientated Analysis, Yourdon Press, ISBN 0-13-629981-4, 2nd Edition, 1991
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2002 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
McEvoy, N., Whitcombe, A. (2002). Structured Risk Analysis. In: Davida, G., Frankel, Y., Rees, O. (eds) Infrastructure Security. InfraSec 2002. Lecture Notes in Computer Science, vol 2437. Springer, Berlin, Heidelberg. https://doi.org/10.1007/3-540-45831-X_7
Download citation
DOI: https://doi.org/10.1007/3-540-45831-X_7
Published:
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-540-44309-4
Online ISBN: 978-3-540-45831-9
eBook Packages: Springer Book Archive