Measuring it security risk based on key risk indicator

초록

This paper presents a method for measuring the IT risk using the concept of key risk indicator (KRI). This suggestion is meaningful in that it shows the concrete risk rate in IT security risk as an indicator. As organizations were demanded to show the cost effectiveness, IT security department adopted the KPI. However, there are some limitations in adopting the KPI in IT part. As the concept of KPI has been also developed to measure the performance in large companies, it is hard to adopt KPI in small and medium sized companies. Moreover, KPI insists on reward from the result. It influences on decision-making such as human resource or budget though KPI is a kind of abstract goal. KRI can be utilized as a risk measurable variable. This paper shows that KRI is more effective than KPI in order to measure the potential risk in IT. It helps to measure the IT security risk, to make the decision to prevent potential security risk from occurring. This concept can play a bridge role in measuring the KPI in IT security. © 2015 ICIC International.

키워드