IT Security Risk Management Model for Handling IT-Related Security Incidents: The Need for a New Escalation Approach

Background And Related Works

In this work, the term IT security risk is used to distinguish it from other business risks like investment risk, credit risk, market risk, and environmental risk. The National Institute of Standards and Technology (NIST) (2002) has proposed the following definition of risk: “Risk is a function of the likelihood of a given threat-source’s exercising a particular potential vulnerability and the resulting impact of that adverse event on the organization” (p. 8). Given this definition, IT security risks are then defined as an adverse event affecting the IT systems of an organization.

All organizations today have some kind of information system (IS) based on information technology (IT). Organizations are exposed to different threats from both inside and outside. These threats can be avoided with the help of countermeasures of different kinds. However, it is difficult to justify spending effort on countermeasures for an IT system that has little business impact for the organization. To find the right mix of countermeasures to assist organizations, several IT security risk management methods and tools have been developed.