Triangulating the Views of Human and non-Human Stakeholders in Information System Security Risk Assessment

摘要

The risk assessment methodologies that are portrayed in traditional information security management literature often do not scale into the multi-level stakeholder environment of corporate governance. This is because they focus on one type of stakeholder, the IT infrastructure. A risk assessment methodology that is to successfully operate in such an environment must have effective mechanisms of including and incorporating the risk perceptions of all the different stakeholders. This does not mean that the traditional forms of information security risk assessment should be replaced; on the contrary rigorous IT infrastructure risk assessment is fundamental to good security management. This work considers how interaction between the stakeholders might take place and this short paper explores the different techniques to promote inclusiveness of the different stakeholder communities in the risk assessment process and uses case studies and field observations gathered in 35 organisations over seven years to illustrate the theory.