Economic aspects and needs in IT-security risk management for SMEs
Markus D. Klemen · 2004
Business success depends increasingly on reliable IT-infrastructure. IT-security risk management aims at an optimal allocation of security resources regarding an "affordable" IT-security level. In comparison to large corporations small and medium-sized enterprises (SMEs) typically have few resources and little expertise in IT-security risk management. Therefore, they need SME-focused framework processes and methods for strategic planning and operational tool support. Long-term goal is to improve the general security level of SME IT infrastructure. We argue for a closer tie between economical and technical aspects of IT-security risk management. Based on the RiskIt risk management process we propose empirical investigations to tackle SME-specific data needs for risk analysis and multiobjective optimization for risk-countermeasure resource allocation.