Collaborative risk method for information security management practices: A case context within Turkey

Cyber Security Risk Assessment of a DDoS Attack

“…This argument may still hold true, although there has been published empirical studies on information security issues since the Kotulic and Clark study (e.g. [39,86,115,43]), there is still a gap regarding ISRA practices. Sufficient to say, ISRM as a research field presents several interesting research problems.…”

“…Which makes it a challenge to detect and treat risks within human performance, human errors, and organization wide factors [35]. While Ozkan and Karabacak [115] point to a similar misconception: such as IS being a purely technical task that can be successfully performed by the IT department only, IS is company-wide and the IT department in general does not have sufficient power to run such a program and seldom have a holistic view of the organization. The same authors also highlight the misconception that consultancy firms can and should achieve IS management for an organization.…”

“…Zhiwei further claims that safeguarding information should not be the main target of information security it should be to guarantee the reliability and security in the operational processes and goals in the organization. Ozkan and Karabacak [115] points to the lack of knowledge from IS/IT professionals regarding the intersection between business and IT processes as being a problem, a risk assessment will lack completeness and produce erroneous results if the practitioners do not have a firm grasp of the business processes. Another cause for organizational disconnect in ISRM mentioned by Ozkan and Karabacak [115] is when the IT-department are being the drivers and doers of ISRM and ISMS work.…”

A Comparison between Business Process Management and Information Security Management

“…Ozkan and Karabacak [22] suggests that process modeling can be used to ease the use of risk analysis methods and move the IS focus from hardware and software over to IT processes. The authors suggests using process modeling to model the activities of the information processing and to determine the scope of the risk analysis.…”

“…However, these external groups are per BPM definition not important stakeholders, ISO/IEC 27001:2013 address the stakeholder needs in section 4.2 Understanding the needs and expectations of interested parties, but we can not see this reflected in the control objectives. The ISMS-program risk failing if key stakeholders lose interest, several instances of failure due to not having sufficiently powerful allies is highlighted in [22]. Although not completely neglected by IS, there is a clear gap between how much emphasis BPM and ISRM put on stakeholder management.…”