Information security risk assessment toolkit: practical assessments through data collection and data analysis

摘要

The distinction between information security risk and business risk is blurrier today than in the past: risk management nowadays plays an important role in business decision making, and helps to align information technology (IT) with business strategies. Nevertheless, the term "risk" is often inconsistently associated with technology-centric aspects, and stakeholders fail to recognize the difference between IT operational risks addressed at an IT operational level and business risks related to IT.In this context, the toolkit presented in this book can be seen as a guide to help information security practitioners choose the most appropriate approach. The authors provide a methodology that starts with the most commonly used frameworks and proposes a step-by-step structured risk assessment through data collection and analysis.