IT Risk Management: Towards a System for Enhancing Objectivity in Asset Valuation That Engenders a Security Culture
In today’s technology-centric business environment, where organizations encounter numerous cyber threats, effective IT risk management is crucial. An objective risk assessment—based on information relating to business requirements, human elements, and the security culture within an organisation—can...
| Main Authors: | , , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
MDPI AG
2024-01-01
|
| Series: | Information |
| Subjects: | |
| Online Access: | https://www.mdpi.com/2078-2489/15/1/55 |
| _version_ | 1797343447322984448 |
|---|---|
| author | Bilgin Metin Sefa Duran Eda Telli Meltem Mutlutürk Martin Wynn |
| author_facet | Bilgin Metin Sefa Duran Eda Telli Meltem Mutlutürk Martin Wynn |
| author_sort | Bilgin Metin |
| collection | DOAJ |
| description | In today’s technology-centric business environment, where organizations encounter numerous cyber threats, effective IT risk management is crucial. An objective risk assessment—based on information relating to business requirements, human elements, and the security culture within an organisation—can provide a sound basis for informed decision making, effective risk prioritisation, and the implementation of suitable security measures. This paper focuses on asset valuation, supply chain risk, and enhanced objectivity—via a “segregation of duties” approach—to extend and apply the capabilities of an established security culture framework. The resultant system design aims at mitigating subjectivity in IT risk assessments, thereby diminishing personal biases and presumptions to provide a more transparent and accurate understanding of the real risks involved. Survey responses from 16 practitioners working in the private and public sectors confirmed the validity of the approach but suggest it may be more workable in larger organisations where resources allow dedicated risk professionals to operate. This research contributes to the literature on IT and cyber risk management and provides new perspectives on the need to improve objectivity in asset valuation and risk assessment. |
| first_indexed | 2024-03-08T10:47:49Z |
| format | Article |
| id | doaj.art-f2a5239191b345cfb5713d0ff3e193a6 |
| institution | Directory Open Access Journal |
| issn | 2078-2489 |
| language | English |
| last_indexed | 2024-03-08T10:47:49Z |
| publishDate | 2024-01-01 |
| publisher | MDPI AG |
| record_format | Article |
| series | Information |
| spelling | doaj.art-f2a5239191b345cfb5713d0ff3e193a62024-01-26T17:03:49ZengMDPI AGInformation2078-24892024-01-011515510.3390/info15010055IT Risk Management: Towards a System for Enhancing Objectivity in Asset Valuation That Engenders a Security CultureBilgin Metin0Sefa Duran1Eda Telli2Meltem Mutlutürk3Martin Wynn4Department of Management Information Systems, Bogazici University, Hisar Campus, Bebek, Istanbul 34342, TurkeyIndependent Researchers, 2628 TJ Delft, The NetherlandsIndependent Researchers, Istanbul 34660, TurkeyDepartment of Management Information Systems, Bogazici University, Hisar Campus, Bebek, Istanbul 34342, TurkeyThe School of Business, Computing and Social Sciences, University of Gloucestershire, Cheltenham GL50 2RH, UKIn today’s technology-centric business environment, where organizations encounter numerous cyber threats, effective IT risk management is crucial. An objective risk assessment—based on information relating to business requirements, human elements, and the security culture within an organisation—can provide a sound basis for informed decision making, effective risk prioritisation, and the implementation of suitable security measures. This paper focuses on asset valuation, supply chain risk, and enhanced objectivity—via a “segregation of duties” approach—to extend and apply the capabilities of an established security culture framework. The resultant system design aims at mitigating subjectivity in IT risk assessments, thereby diminishing personal biases and presumptions to provide a more transparent and accurate understanding of the real risks involved. Survey responses from 16 practitioners working in the private and public sectors confirmed the validity of the approach but suggest it may be more workable in larger organisations where resources allow dedicated risk professionals to operate. This research contributes to the literature on IT and cyber risk management and provides new perspectives on the need to improve objectivity in asset valuation and risk assessment.https://www.mdpi.com/2078-2489/15/1/55risk assessmentasset valueinformation securityrisk managementobjective risk assessmentsegregation of duties |
| spellingShingle | Bilgin Metin Sefa Duran Eda Telli Meltem Mutlutürk Martin Wynn IT Risk Management: Towards a System for Enhancing Objectivity in Asset Valuation That Engenders a Security Culture Information risk assessment asset value information security risk management objective risk assessment segregation of duties |
| title | IT Risk Management: Towards a System for Enhancing Objectivity in Asset Valuation That Engenders a Security Culture |
| title_full | IT Risk Management: Towards a System for Enhancing Objectivity in Asset Valuation That Engenders a Security Culture |
| title_fullStr | IT Risk Management: Towards a System for Enhancing Objectivity in Asset Valuation That Engenders a Security Culture |
| title_full_unstemmed | IT Risk Management: Towards a System for Enhancing Objectivity in Asset Valuation That Engenders a Security Culture |
| title_short | IT Risk Management: Towards a System for Enhancing Objectivity in Asset Valuation That Engenders a Security Culture |
| title_sort | it risk management towards a system for enhancing objectivity in asset valuation that engenders a security culture |
| topic | risk assessment asset value information security risk management objective risk assessment segregation of duties |
| url | https://www.mdpi.com/2078-2489/15/1/55 |
| work_keys_str_mv | AT bilginmetin itriskmanagementtowardsasystemforenhancingobjectivityinassetvaluationthatengendersasecurityculture AT sefaduran itriskmanagementtowardsasystemforenhancingobjectivityinassetvaluationthatengendersasecurityculture AT edatelli itriskmanagementtowardsasystemforenhancingobjectivityinassetvaluationthatengendersasecurityculture AT meltemmutluturk itriskmanagementtowardsasystemforenhancingobjectivityinassetvaluationthatengendersasecurityculture AT martinwynn itriskmanagementtowardsasystemforenhancingobjectivityinassetvaluationthatengendersasecurityculture |