Risk Reduction Overview

A Visualization Method for Risk Management
  • Hellen Nanda Janine Havinga
  • Olivier Diederik Theobald Sessink
Part of the Lecture Notes in Computer Science book series (LNCS, volume 8708)


The Risk Reduction Overview (RRO) method presents a comprehensible overview of the coherence of risks, measures and residual risks. The method is designed to support communication between different stakeholders in complex risk management. Seven reasons are addressed why risk management in IT security has many uncertainties and fast changing factors, four for IT security in general and three for large organizations specifically. The RRO visualization has been proven valuable to discuss, optimize, evaluate, and audit a design or a change in a complex environment. The method has been used, evaluated, and improved over the last six years in large government and military organizations. Seven areas in design and decision making are identified in which a RRO is found to be beneficial. Despite the widely accepted need for risk management we believe this is the first practical method that delivers a comprehensive overview that improves communication between different stakeholders.


Design Security Residual risk Risk management Security measure Visualization 


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Acquisti, A., Friedman, A., Telang, R. Is there a cost to privacy breaches? An event study. In: Fifth Workshop on the Economics of Information Security. Cambridge (2006) Google Scholar
  2. 2.
    Arora, A., Hall, D., Pinto, C., Ramsey, D., Telang, R.: An ounce of prevention vs. a pound of cure: How can we measure the value of IT security solutions? Lawrence Berkeley National Laboratory, University of California (2004)Google Scholar
  3. 3.
    Berinato, S.: Finally, a real return on security spending. CIO Magazine, 43–52 (2002)Google Scholar
  4. 4.
    Bornman, G., Labuschagne, L.: A comparative framework for evaluating information security risk management methods. In: Proceedings of the Information Security South Africa Conference, ISSA (2004)Google Scholar
  5. 5.
    Garg, A., Curtis, J., Halper, H.: Quantifying the financial impact of IT security breaches. Information Management and Computer Security 11(2), 74–83 (2003)CrossRefGoogle Scholar
  6. 6.
    Gordon, L., Loeb, M.: The economics of information security investment. ACM Transaction on Information and System Security 5(4), 438–457 (2002)CrossRefGoogle Scholar
  7. 7.
    Hoo, K.J.S.: How much is enough? A risk management approach to computer security. Doctoral Thesis, Stanford University (2000)Google Scholar
  8. 8.
  9. 9.
    Joint Task Force Transformation Initiative: Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach. NIST Special Publication 800-37, Revision 1. Computer Security Division, Information Technology Laboratory, National Institute of Standards and Technology (2010)Google Scholar
  10. 10.
    Joint Technical Committee ISO/IEC JTC 1/SC 27: ISO/IEC 27005:2011 Information technology — Security techniques — Information security risk management. International Organization for Standardization, Geneva (2011)Google Scholar
  11. 11.
    Longstaff, T., Chittister, C., Pethia, R., Haimes, Y.: Are we forgetting the risk of information technology? Computer 33(12), 43–51 (2000)CrossRefGoogle Scholar
  12. 12.
    Martin, R.A.: Managing Vulnerabilities in Networked Systems. Computer 34(11), 32–38 (2001)CrossRefGoogle Scholar
  13. 13.
    Neubauer, T., Klemen, M., Biffl, S.: Business process-based valuation of IT-security. In: Sullivan, K. (ed.) Proceedings of the 7th International Workshop on Economics-Driven Software Engineering Research, ICSE, pp. 1–5. ACM, New York (2005)Google Scholar
  14. 14.
    Risk Reduction Overview example, http://rro.sourceforge.net/examples.html
  15. 15.
    Risk Reduction Overview website, http://rro.sourceforge.net/
  16. 16.
    Roy, A., Kim, D.S., Trivedi, K.S.: Attack countermeasure trees (ACT): Towards unifying the constructs of attack and defense trees. In: Security and Communication Networks, pp. 929–943 (2012)Google Scholar
  17. 17.
    Schneier, B.: Attack Trees. Dr. Dobb’s Journal of Software Tools 24(12), 21–29 (1999)Google Scholar

Copyright information

© IFIP International Federation for Information Processing 2014

Authors and Affiliations

  • Hellen Nanda Janine Havinga
    • 1
  • Olivier Diederik Theobald Sessink
    • 2
  1. 1.Rijkswaterstaat, Central Information ServicesDelftThe Netherlands
  2. 2.Ministry of DefenseThe HagueThe Netherlands

Personalised recommendations