Information Security Risk Management: An Intelligence-Driven Approach
Jeb Webb, Sean B. Maynard, Atif Ahmad, Graeme Shanks · AJIS. Australasian journal of information systems/AJIS. Australian journal of information systems/Australian journal of information systems · 2014
Three deficiencies exist in the organisational practice of information security risk management: risk assessments are commonly perfunctory, security risks are estimated without investigation; risk is assessed on an occasional (as opposed to continuous) basis.These tendencies indicate that important data is being missed and that the situation awareness of decision-makers in many organisations is currently inadequate.This research-in-progress paper uses Endsley's situation awareness theory, and examines how the structure and functions of the US national security intelligence enterprise-a revelatory case of enterprise situation awareness development in security and risk management-correspond with Endsley's theoretical model, and how facets of the US enterprise might be adapted to improve situation awareness in the information security risk management process of organisations.