Computer Security Risk Analysis and Management

Abstract

• evaluation of the effectiveness of existing computing security measures;

• estimation of the cost to the organization if current defences are inadequate;

• selection of appropriate, cost-effective countermeasures.

Risk analysis is a familiar concept in business as well as in everyday life. The fundamental problem is universal: how much should I pay now to reduce the possibility of some hypothetical event costing me dearly? Which one of several possible outlays reduces the likelihood most?