PRISM: a strategic decision framework for cybersecurity risk assessment
PRISM: a strategic decision framework for cybersecurity risk assessment
复制标题
PRISM：网络安全风险评估的战略决策框架
DOI：
10.1108/ics-11-2018-0131
复制
发表时间：
2020
期刊：
影响因子：
--
通讯作者：
J. Haddow
中科院分区：
文献类型：
--
作者：
R. Goel;Anupam Kumar;J. Haddow
目的
本研究旨在为组织中的网络安全风险评估制定一个框架。现有的网络安全框架很复杂，而且以实施为导向。该框架可以系统地用于评估公司在网络安全态势方面的战略方向。我们的目标是帮助高层管理团队在管理组织网络风险的同时，制定有关安全投资的决策。
设计/方法/方式
利用内容分析技术对现有出版物进行专题分析，得出一套初步的重要关键词。使用关键词的其他因素分析为我们提供了一个由五个支柱组成的框架，包括优先级，资源，实施，标准化和监测（PRISM），用于评估公司的战略网络安全方向。
结果
主要贡献是开发了一个新的PRISM框架，使网络决策者能够确定并实施量身定制的方法来解决风险管理和网络安全问题。PRISM框架评估将帮助组织识别和实施适用于其问题的最适合的风险管理和网络安全方法。
独创性/价值
新的规范是让公司意识到网络空间中的数据分层扩展到整个组织，将他们对网络安全的需求与业务运营交织在一起。本文满足了一个确定的需要，提高公司领导者的能力，作为首席信息官和其他人，以解决组织如何通过使用跨组织网络安全风险管理的方法来更好地处理网络威胁这一日益增长的问题。
Purpose
This study aims to develop a framework for cybersecurity risk assessment in an organization. Existing cybersecurity frameworks are complex and implementation oriented. The framework can be systematically used to assess the strategic orientation of a firm with respect to its cybersecurity posture. The goal is to assist top-management-team with tailoring their decision-making about security investments while managing cyber risk at their organization.
Design/methodology/approach
A thematic analysis of existing publications using content analysis techniques generates the initial set of keywords of significance. Additional factor analysis using the keywords provides us with a framework comprising of five pillars comprising prioritize, resource, implement, standardize and monitor (PRISM) for assessing a firm’s strategic cybersecurity orientation.
Findings
The primary contribution is the development of a novel PRISM framework, which enables cyber decision-makers to identify and operationalize a tailored approach to address risk management and cybersecurity problems. PRISM framework evaluation will help organizations identify and implement the most tailored risk management and cybersecurity approach applicable to their problem(s).
Originality/value
The new norm is for companies to realize that data stratification in cyberspace extends throughout their organizations, intertwining their need for cybersecurity within business operations. This paper fulfills an identified need improve the ability of company leaders, as CIOs and others, to address the growing problem of how organizations can better handle cyber threats by using an approach that is a methodology for cross-organization cybersecurity risk management.