Using an Enterprise Architecture for IT Risk Management.

Information Security for South AfricaPublished 1 January 2006

Frank Innerhofer-Oberperfler, Ruth Breu

Citations48

TL;DR

The proposed approach provides a detailed process of security management and defines the necessary responsibilities and roles of the participating stake-holders to bridge the technical and business oriented views on information security.

Abstract

In this paper we propose a novel approach for the systematic assessment and analysis of IT related risks in organisations and projects. The approach is model-driven using an enterprise architecture as the basis for the security management process. Using an enterprise architecture it is possible to provide an integrated description of an organisation’s structure, processes and its underlying IT landscape. That way we want to bridge the technical and business oriented views on information security. The proposed approach provides a detailed process of security management and defines the necessary responsibilities and roles of the participating stake-holders.

Keywords

Computer ScienceBusiness, Management and Accounting

IBM Systems JournalA framework for information systems architecture

3,198 Citations1987John A. Zachman

Information systems architecture is defined by creating a descriptive framework from disciplines quite independent of information systems, then by analogy specifies information systems architecture based upon the neutral, objective framework.

CERN Document Server (European Organization for Nuclear Research)Managing Information Security Risks: The OCTAVE Approach

352 Citations2002Christopher Alberts, Audrey Dorofee

This paper focuses on the implementation of the OCTAVE method in Small Organizations, which aims to provide a single approach to information security risk evaluation and management in the context of managed service providers.

Auerbach Publications eBooksInformation Security Risk Analysis

342 Citations2005Thomas R. Peltier, Thomas R. Peltier

Business Process Modelling

160 Citations1996Bernd Scholz‐Reiter, Eberhard Stickel

From Business Process Modelling to Workflow Management: An Integrated Approach to the Modelling, Execution, and Monitoring of Workflow-Based Processes.

Information & ManagementThe IS risk analysis based on a business model

140 Citations2003Bomil Suh, Ingoo Han

This study presents an IS risk analysis method based on a business model that uses a systematic quantitative approach dealing with operational continuity and adds the first stage, organizational investigation, to traditional risk analysis.

Computers & SecurityFrom information security to…business security?

93 Citations2005Basie von Solms, Rossouw von Solms

This short opinion paper argues that information security, the discipline responsible for protecting a company's information assets against business risks, has now become such a crucial component of good Corporate Governance, that it should rather be called Business Security instead of Information Security.

Computers & SecurityOperationalizing IT Risk Management

42 Citations2003Robert S. Coles, Rolf Moulton

In a study of four major global organisations conducted during 2002, it was found that all conducted some form of risk assessment to assist in the management of security risks, but three of the four organisations had major gaps in their risk assessment coverage.

OPAL (Open@LaTrobe) (La Trobe University)Managing for Enterprise Security

31 Citations2004Richard A. Caralli

To sustain success, security at an enterprise level requires that the organization move toward a security management process that is strategic, systematic, and repeatable-in other words, efficient at using security resources and effective at meeting security goals on a consistent basis.

View PDF

Lecture notes in computer scienceInformation Security Risk Assessment, Aggregation, and Mitigation

24 Citations2004Arjen K. Lenstra, T.J. Voss

This paper describes work in progress on a new quantitative model to assess and aggregate information security risks that is currently under development for deployment and shows how to find a risk mitigation strategy that is optimal with respect to the model used and the available budget.

View PDF

Information Systems SecurityEnterprise Security Management: Managing Complexity

6 Citations2001Matunda Nyanchama, Paul Sop

Information Security is a key component in modern enterprise planning and management given the integral role of information technology in today's enterprise.