Qualitative and Quantitative Risk Assessment through IISRA Framework

Abstract

Abstract: Information and communications technology (ICT) has expanded commercial potential beyond comprehension and has merged completely with organizations. In addition to its many advantages, ICT has disadvantages, such as cybersecurity risks, vulnerabilities, and a lack of adequate administrative access control that cybercriminals might take advantage of. Organizations are becoming more dependent on information security as a result of potential hazards brought on by advances in information technology, each of which has a different critical level based on its likelihood of happening and potential consequences. Methodologies for evaluating information security threats can be either quantitative or qualitative, depending on the Information outcome of their assessment. It is clear that both of the aforementioned choices have a number of fundamental flaws. In order to overcome them, this research paper focused on developing an Integrated Information Security Risk Assessment (IISRA) Framework that would be both more accurate and adaptable because existing approaches are frequently inappropriate and ineffectual due to the ongoing appearance of new sources of risks.