Title :
Performance Metrics for Information Security Risk Management
Author :
Ryan, Julie J C H ; Ryan, Daniel J.
Author_Institution :
George Washington Univ., Washington, DC
Abstract :
Qualitative methods are available for risk management, but better practice would use quantitative risk management based on expected losses and related metrics. Measuring the success of information security investments is best accomplished by measuring reductions in expected loss.
Keywords :
risk management; security of data; information security; performance metrics; qualitative methods; risk management; Control systems; Data security; Equations; Information management; Information security; Investments; Loss measurement; Privacy; Risk analysis; Risk management; information security; risk management; security and protection; security metrics;
Journal_Title :
Security & Privacy, IEEE
DOI :
10.1109/MSP.2008.125
