IT Risk Assessment: Quantitative and Qualitative Approach
Artur Rot · 2008
Abstract — IT risk management currently plays more and more important role in almost all aspects of contemporary organizations ’ functionality. It requires reliable and cyclical realization of its key task which is risk analysis. Literature of subject presents problems of risk analysis in different way, the most often skipped or selectively treated the problem of quantitative methods application for the purpose of risk analysis. The article presents the issue of one of the most significant stages of risk analysis which is IT risk assessment, especially focusing on chosen quantitative methods such as ALE (Annual Loss Expected) method, Courtney method, Fisher’s method, using survey research ISRAM model (Information Security Risk Analysis Method) and other derived ratios. There were also shortly presented chosen qualitative methods – FMEA (Failure Mode and Effects Analysis) and FMECA (Failure Mode and Effects Criticality Analysis), NIST SP 800-30 method and CRAMM methodology. Index Terms — IT risk, IT security risk analysis methods, qualitative risk assessment methods, quantitative risk assessment methods. I.