Abstract

The past decade has shown the importance of information security, with special emphasis on network security, disaster recovery and risk management. A number of automated approaches for the facilitation of a risk analysis study have appeared on the software market. Organizations today face the difficult task not only of executing a risk analysis study, but also of selecting a method that will best suit their requirements.

A number of methods are available today, utilizing different terminology for similar concepts. Risk analysis, the most commonly used term in this field, is mostly used to identify objects for protection. “Risk management” might also be included as part of risk analysis, depending on the functionality of the method used. Automated risk analysis methods need to be viewed not only from the internal operation of the method but also from a terminological point of view.

The objective of this paper is to suggest a framework for risk management terminology. The application of the framework will be demonstrated through a high level discussion of the CRAMM, LAVA and MELISA risk analysis methods.

Author Keywords: Information security; Risk analysis; Risk assessment; Risk management; Automated risk analysis approaches; Risk monitoring

Article Outline

• References