The Fallacies of Information Security Risk Analysis

• Main Authors: Kuan-Chang Chen, 陳冠彰
• Other Authors: Te-Chao Liang
• Format: Others
• Language: zh-TW
• Published: 2005
• Online Access: http://ndltd.ncl.edu.tw/handle/30985264143993682867

碩士 === 淡江大學 === 資訊管理學系碩士班 === 93 === Risk assessment is a critical step before performing information security management. Usually, risk is a subjective judgment, hence qualitative risk analysis methods are widely use for risk assessment. However, important information assets are often being omitted while using many popular risk analysis methods. For this reason, this thesis will point out the problem in using qualitative risk analysis methods, especially in rationality of assets calculation and the rank reversal phenomenon. The cautious when using qualitative risk analysis methods are then being addressed. Furthermore, the most common referred international standards and guides are reviewed. Suggestions for using those methods are also proposed.