Document Type
Journal Article
Publication Date
2005
Abstract
Continuously changing nature of technological environment has been enforcing to revise the process of information security risk analysis accordingly. A number of quantitative and qualitative risk analysis methods have been proposed by researchers and vendors. The purpose of these methods is to analyze today's information security risks properly. Some of these methods are supported by a software package. In this study, a survey based quantitative approach is proposed to analyze security risks of information technologies by taking current necessities into consideration. The new method is named as Information Security Risk Analysis Method (ISRAM). Case study has shown that ISRAM yields consistent results in a reasonable time period by allowing the participation of the manager and staff of the organization.
College/Unit
College of Arts, Sciences and Technology
Publication or Event Title
Computers & Security
Volume
24
Issue
2
First Page
147
Last Page
159
DOI
10.1016/j.cose.2004.07.004
Creative Commons License
This work is licensed under a Creative Commons Attribution-NonCommercial-No Derivative Works 4.0 International License.
Recommended Citation
Karabacak, B., & Sogukpinar, I. (2005). ISRAM: information security risk analysis method. Computers & Security, 24 (2), 147-159. https://doi.org/10.1016/j.cose.2004.07.004