Necessary measures: Metric-driven information security risk assessment and decision making

Communications of the ACM

Volumn 50, Issue 10, 2007, Pages 101-106

  Baker, Wade H ^a,b   Rees, Loren Paul ^b   Tippett, Peter S ^a,c  

^a Verizon Business Internet Engineering Organization   (United States)

^b VIRGINIA POLYTECHNIC INSTITUTE AND STATE UNIVERSITY   (United States)

^c ICSA Labs

Author keywords

[No Author keywords available]

Indexed keywords

COMPUTATION THEORY; DATA ACQUISITION; DECISION MAKING; MATHEMATICAL MODELS; RISK ASSESSMENT;

MODEL SECURITY; SECURITY INITIATIVES;

SECURITY OF DATA;

EID: 34848920878     PISSN: 00010782     EISSN: 15577317     Source Type: Journal    
DOI: 10.1145/1290958.1290969     Document Type: Article

References (11)

1. Berinato, S. The state of information security 2003. CIO Magazine 17, 2 (Oct. 15, 2003).
2. Cavusoglu, H., Mishra, B., and Rathunathan, S. The effect of information security breach announcements on shareholder wealth: Capital market reactions for breached firms and Internet security developers. International Journal of Electronic Commerce 9, 1 (Fall 2004), 69-104.
3. Cavusoglu, H., Mishra, B., and Raghunathan, S. A model for evaluating IT security investments. Commun. ACM 47, 7 (July 2004), 87-92.
4. Daft, R. and Lengel, R. Organizational information requirements, media richness, and structural design. Management Science 32, 4 (May 1986), 554-569.
5. Gordon, L. and Loeb, M. The economics of information security investment. ACM Transactions on Information and Systems Security 5, 4 (Nov. 2002), 438-457.
6. Howard, J. and Longstaff, T. A Common Language for Computer Security Incidents. Sandia National Laboratories Report SAND98-8667, Oct. 1998; www.cert.org/research/taxonomy_988667.pdf.
7. Jaisingh, J. and Rees, J. Value at risk: A methodology for information security risk assessment. In Proceedings of the INFORMS Conference on Information Systems and Technology (Miami, Nov. 3-4, 2001).
8. Straub, D. and Welke, R. Coping with systems risk: Security planning models for management decision making. MIS Quarterly 22, 4 (Dec. 1998), 441-470.
9. Swanson, M., Bartol, N., Sabato, J., and Graffo, L. Security Metrics Guide for Information Technology Systems. National Institute of Standards and Technology Special Publication 800-55, Gaithersburg, MD, July 2003.
10. Verton, D. DHS seeks real-world data on security breaches. Computerworld (Sept. 20, 2004).
11. Whitman, M. Enemy at the gate: Threats to information security. Commun. ACM 46, 8 (Aug. 2003), 91-95.