Security risk assessment: toward a comprehensive practical risk management

Abstract

This paper introduces a unique approach to a more integrated security risk assessment SRA. This is formalised based on the proven mathematical methods described in various articles in the literature and combined with the work developed by the author. Whilst the widely used qualitative frameworks were introduced by existing international standards, the approach presented in this paper provides a novel way of better managing security risks in organisations. It uses a combination of qualitative and ranking methods based on a distance-based approach. The successful implementation of this approach in one of the world's largest financial institutions provided an alternative and unconventional means of performing more practical integrated security risk management, in a manner consistent with the current set of standards and practices. The method used in this paper is more effective than the existing single-faceted methods available. It gauges the significance of each risk by ranking them and providing preferences based on users' perspectives. These are qualified and quantified to achieve more comprehensive and effective risk assessment results.