TOWARDS AN ANALYTICS-DRIVEN INFORMATION SECURITY RISK MANAGEMENT: A CONTINGENT RESOURCE BASED PERSPECTIVE

Abstract

Information security risk management (ISRM) is a continuous process that integrates identification and analysis of risks to which an organisation is exposed, assessment of likelihood of potential threats and their impact on the business, and deciding what actions need to be taken to eliminate or reduce risk to an acceptable level. Our review of the literature highlights two trends in organizational practice of ISRM: (1) security risks are not analysed and monitored continuously and historically (2) security risks are assessed based on speculation rather than evidence. Business analytics (BA) provides organizations with a unique opportunity to develop specialised capabilities (security analyt..