A Management Perspective on Risk of Security Threats to Information Systems

  • Authors:

  • Fariborz Farahmand;Shamkant B. Navathe;Gunter P. Sharp;Philip H. Enslow

  • Affiliations:

  • College of Computing, Georgia Institute of Technology, Atlanta, Georgia 30332-0280;School of Industrial and Systems Engineering, Georgia Institute of Technology, Georgia;College of Computing, Georgia Institute of Technology, Atlanta 30332-0280;College of Computing, Georgia Institute of Technology, Atlanta 30332-0280

  • Venue:
  • Information Technology and Management
  • Year:
  • 2005

Quantified Score

Hi-index 0.00

Visualization

Abstract

Electronic commerce and the Internet have enabled businesses to reduce costs, attain greater market reach, and develop closer partner and customer relationships. However, using the Internet has led to new risks and concerns. This paper provides a management perspective on the issues confronting CIO's and IT managers: it outlines the current state of the art for security in e-commerce, the important issues confronting managers, security enforcement measure/techniques, and potential threats and attacks. It develops a scheme for probabilistic evaluation of the impact of security threats with some illustrative examples. This methodology may be used to assess the probability of success of attacks on information assets in organizations, and to evaluate the expected damages of these attacks. The paper also outlines some possible remedies, suggested controls and countermeasures. Finally, it proposes the development of cost models which quantify damages of these attacks and the effort of confronting these attacks. The construction of one such cost model for security risk assessment is also outlined. It helps decision makers to select the appropriate choice of countermeasure(s) to minimize damages/losses due to security incidents. Finally, some recommendations for future work are provided to improve the management of security in organizations on the whole.