Structured Risk Analysis

Abstract

Decisions concerning the security of information are frequently taken on a different basis to other business decisions. Necessary investments may not take place on the grounds that the returns are not easily quantifiable, when compared with other investments, or in the blithe hope that “it will never happen to us”. Conversely, “fear, uncertainty and doubt” can lead organisations to divert funds towards information security that might be better spent elsewhere. This paper presents Structured Risk Analysis (SRA), a method to help organisations take rational steps to improve their information security. Using SRA, an organisation can place information security in the context of the business as a whole, to determine the appropriate level of resources to be directed toward improvements. Given this budget, SRA enables the organisation to identify how it should be spent to generate the best possible security ‘return’.

Whilst other risk analysis methods exist, we believe SRA to be more closely integrated with other business processes, systems development and operations, giving a much firmer context for the analysis and more confidence in the results. It is non-proprietary, does not require specialist software tools and is inherently ‘tuneable’ in the level of detail that is applied: all of which means that SRA is particularly cost-effective.

We believe SRA gives business owners the information they need to make truly informed decisions about the security, viability and future direction of their Information Systems.