Informationssicherheit – ohne methodische Risikoidentifizierung ist alles Nichts
详细信息 查看全文
- 作者：Karsten M. Decker
- 关键词：SchlüsselwörterInformationssicherheit ; Risikomanagementprozess ; Risikoidentifizierung ; Führung und Verpflichtung der obersten Leitung ; Ausbildung ; Schulung ; Sensibilisierung ; Risikobewusstsein ; Fortlaufende Verbesserung
- 刊名：HMD Praxis der Wirtschaftsinformatik
- 出版年：2017
- 出版时间：February 2017
- 年：2017
- 卷：54
- 期：1
- 页码：21-36
- 全文大小：
- 刊物类别：Computer Science, general; Economics/Management Science, general;
- 刊物主题：Computer Science, general; IT in Business;
- 出版者：Springer Fachmedien Wiesbaden
- ISSN：2198-2775
- 卷排序：54
文摘
Information security is not an IT problem and cannot be reduced to the IT department. Effective protection of confidentiality, integrity and availability must be anchored throughout the organization. To address this challenge efficiently, a risk-based approach is required. To this end, the organizational context must first be determined. When applying the risk management process, the quality of risk identification is crucial. Risks that are not identified here are missing in the subsequent risk analysis and risk evaluation and thus also in risk treatment. There are various approaches for methodological risk identification, two of which are presented: the predominantly effect-oriented event-based approach, and the cause-oriented approach based on the consideration of assets, threats and vulnerabilities. In order to implement risk identification in practice, various prerequisites must be fulfilled. It is crucial that top management takes its leadership role comprehensively and effectively. The key challenge is to keep the scope of risk identification manageable. To this end, the approaches of focusing and coarsening have proved successful in practice. Irrespective of the chosen approach to risk identification, a profound assessment capacity is essential. By means of the process of continual improvement, an initially high level but clear picture of the information security risks can be refined step by step and adapted to the current requirements and threats.