INTEGRATING TECHNICAL APPROACHES, ORGANISATIONAL ISSUES, AND HUMAN FACTORS IN SECURITY RISK ASSESSMENT BY ORGANISING SECURITY RELATED QUESTIONS

摘要

This paper aims to develop a multiple perspective framework for employee security risk assessment by simultaneously, not sequentially, addressing three distinct perspectives: technical, organisational, and human factor perspectives. Interactions between technical approaches and human factors, and between organisational issues and human factors are investigated. A security related question library that integrates organisational culture and human factors with network security risk assessment in a BS ISO/IEC 27001 compliant environment is established in order to identify security vulnerabilities.