The State of Risk Assessment Practices in Information Security: An Exploratory Investigation

Conduct Security Assessment •Information Assets •Physical Assets Conduct Security Assessment •Information Assets •Physical Assets Assess Business Risk •Estimate Threats •Assign Probabilities of Loss Assess Business Risk •Estimate Threats •Assign Probabilities of Loss Develop Security Recommendations •Allocate Resources •Create Procedures Develop Security Recommendations •Allocate Resources •Create Procedures Implement Risk Assessment Results •Integrate into Overall Security Policy Implement Risk Assessment Results •Integrate into Overall Security Policy