Problem Analysis of Traditional IT-Security Risk Assessment Methods - An Experience Report from the Insurance and Auditing Domain

摘要: Traditional information technology (IT) security risk assessment approaches are based on an analysis of events, probabilities and impacts. In practice, experts often find it difficult to determine IT risks reliably with precision. this paper, we review the determination steps traditional report our experience using such approaches. Our is performing audits business insurance cover assessments within a reinsurance company. The paper concludes summary issues concerning that related identification evaluation We also conclude there need develop alternative approaches, suggest requirements-based approach without events probabilities.