RiskPatrol: A risk management system considering the integration risk management with business continuity processes

被引:16
作者
Cha, Shi-Cho [1 ]
Juo, Pei-Wen [1 ]
Liu, Li-Ting [1 ]
Chen, Wei-Ning [1 ]
机构
[1] Natl Taiwan Univ Sci & Technol, Dept Informat Management, Taipei 106, Taiwan
来源
ISI 2008: 2008 IEEE INTERNATIONAL CONFERENCE ON INTELLIGENCE AND SECURITY INFORMATICS | 2008年
关键词
business continuity management; disaster recovery; emergency response; risk management;
D O I
10.1109/ISI.2008.4565039
中图分类号
TP18 [人工智能理论];
学科分类号
081104 ; 0812 ; 0835 ; 1405 ;
摘要
Both business continuity management (BCM) and risk management (RM) processes are very important to current organizations. The former ensures that the organizations have the ability to limit losses in the events of severe contingencies or disasters. The latter helps organizations identify potential security incidents and adopt cost-effective countermeasures to the incidents. However, current risk management approaches or methodologies usually ignore the different focuses about risks in RM processes and BCM processes. Therefore, even though an organization has established its RM processes, it may need to re-assess the risks for BCM processes. In light of this, we propose a risk management system, called RiskPatrol, to provide an integrative vie,,v about risks for RM and BCM processes. RiskPatrol provides an easy way for people to retain enough information for BCM while they do risk assessment in RM process, and vice versa. As the redundant risk assessment work in RM and BCM processes can be reduced, our system can hopefully contribute to overcome the deficiencies of current risk management approaches.
引用
收藏
页码:110 / +
页数:2
相关论文
共 28 条
[11]   Comparative framework for risk analysis methods [J].
Eloff, J.H.P. ;
Labuschagne, L. ;
Badenhorst, K.P. .
Computers and Security, 1993, 12 (06) :597-603
[12]  
GORDON LA, 2002, ACM T INFORM SYST SE, V5, P439
[13]   Returns to information security investment: The effect of alternative information security breach functions on optimal investment and sensitivity to vulnerability [J].
Hausken, Kjell .
INFORMATION SYSTEMS FRONTIERS, 2006, 8 (05) :338-349
[14]  
HOO KJS, 2000, THESIS STANFORD U ST
[15]  
ISO/IEC, 2005, 270012005 ISO IEC
[16]  
*ISO IEC, 1998, 133353 ISOIEC
[17]   ISRAM: information security risk analysis method [J].
Karabacak, B ;
Sogukpinar, I .
COMPUTERS & SECURITY, 2005, 24 (02) :147-159
[18]   A quantitative method for ISO 17799 gap analysis [J].
Karabacak, Bilge ;
Sogukpinar, Ibrahim .
COMPUTERS & SECURITY, 2006, 25 (06) :413-419
[19]  
LUND MS, 2004, UML PROFILE IDENTIFI
[20]  
*MSSC SCOE, 2006, SEC RISK MAN GUID V1