Risk analysis methodology used by several small and medium enterprises in the Czech Republic

Abstract

PurposeThe aim of this paper is to present risk analysis procedures which have been successfully applied by Czech small and medium enterprises (SMEs). The methodology, which is based on the modification and combination of two standard methods, aims to accelerate (and make more affordable) the risk analysis process, as compared to other risk analysis methods used for public organizations and major corporations in the Czech Republic.Design/methodology/approachThe paper presents in detail the individual steps the authors used in risk analysis of SMEs in the Czech Republic. The method is based on the facilitated risk analysis process (FRAP) methodology and the BITS recommendation. Modifications of both methodologies are described in detail.FindingsTo perform risk analysis in the SME sector in the Czech Republic, it is necessary to have a broad portfolio of instruments. Besides using the CRAMM methodology, the authors have created a new method based on combining the BITS and FRAP methods. The advantage of this method is its ability to accelerate the risk analysis, especially the identification and asset evaluation phases. Another advantage is that the method produces simple spreadsheet tables, providing the consumer with a tool that is easily editable and may be used for follow‐up procedures.Practical implicationsThe risk analysis method produces benefits for SMEs by speeding up the risk analysis and lowering its cost. Another benefit is that the method is open‐source and can potentially be further modified.Originality/valueThe paper presents in detail an approach to risk analysis based on the modification of the FRAP methodology and the BITS recommendation.

A utilitarian re-examination of enterprise-scale information security management

“…It would be valuable to identify and categorize the various other major use-cases of security management techniques and the extent to which they are served by published research. Small businesses seem to receive relatively good amounts of research, such as the papers by Debasis Bhattacharya [87] and Ladislav Beranek [88]. Small businesses are probably attractive to researchers in comparison to larger organizations because it is presumably easier to obtain access to managers and other decision makers within a small business.…”

“…This might be because the existing raft of information security consulting services tend to focus on auditing, incident response or the implementation of technical projects. (Beranek, 2011;IBM web site, 2013;Symantec web site, 2013;McAfee web site, 2013).…”

Modelo de gestión de riesgos de seguridad de la información para PYMES peruanas

“…Beranek sugiere un modelo cualitativo basado en la integración de dos metodologías FRAPP y BITS, teniendo como metodología base a BITS. En esta integración, el autor utiliza la evaluación de los activos de FRAPP y para el resto del proceso de análisis se basa en BITS [14].…”

Modelo de gestión de riesgos de seguridad de la información para pymes en el Perú

“…Behnia, Rashid, & Chaudhry (2012) define al análisis de riesgo como la base de la protección de la información, la gestión de riesgos y el riesgo en el proceso de protección de la información. Además, Beranek (2012) indica que el análisis de riesgos de seguridad es fundamental para la seguridad de cualquier organización, ya que esta es esencial para asegurar que los controles son totalmente proporcionales a los riesgos a los que la organización está expuesta y los procesos relevantes están en conformidad con las políticas de seguridad.…”

“…En esta integración, el autor utiliza la evaluación de los activos de FRAPP y para el resto del proceso de análisis se basa en BITS. (Beranek, 2012) Los enfoques cuantitativos utilizan modelos matemáticos y estadísticos para representar el riesgo a diferencia del modelo cualitativo (Feng, Harry, & Li, A security risk analysis model for information systems, 2013). La exposición al riesgo de seguridad se representa como una función de la probabilidad de las amenazas y la pérdida esperada debido a la vulnerabilidad a esas amenazas (Büyüközkan & Ruan, 2010).…”