Research Area: CyberSecurity
We conduct risk assessments to reducing the uncertainty regarding future events in order to make the best decisions possible and to control risk. In industry, the aim is to find the appropriate balance in risk-taking relative to the organizations risk appetite and tolerance. Too many security controls will inhibit business functionality, and the opposite will lead to unacceptable exposure. The complexity in the information and cyber security do-main increases on a daily basis, which makes identifying, analyzing, and controlling the relevant risk events a major challenge.
. Thus, this thesis addresses several aspects of Cyber and Information Security Risk Assessment (ISRA) and Management (ISRM) Practice sand contributes to novel research problems, methods, models, and knowledge within the discipline. This thesis applies the Design Science Research framework to investigate the theoretical and practical issues in ISRA.
Furthermore, empirical studies of method use are necessary to derive cause and effect be-tween method choice, tasks, and results, and to figure out what works in ISRA. There exists multiple comparative assessments of ISRM/RA methods which are primarily scoped to compare method content to a predetermined set of criteria. Although the findings from applying these approaches are useful in understanding ISRA practices, they leave out the tasks and activities not present in the criteria and were not helpful in establishing cause and effect
Name of the Researcher: Gjøvik
Name of the Supervisor(s): Einar Snekkenes
Year of Completion: 2017
University: Norwegian University
Thesis Link: Home Page Url
