In the new Internet economy, risk management plays a critical role to protect the organization and its ability to perform their business mission, not just its IT assets. Risk management is the process of identifying risk, assessing risk, and taking steps to reduce risk to an acceptable level. The risk management is an important component of a IT security program. Information and communications technology management and IT security are responsible for ensuring that technology risks are managed appropriately. These risks originate from the deployment and use of IT assets in various ways, such as configuring systems incorrectly or gaining access to restricted software.risk, e-business, threat, vulnerability

Floarea NASTASE

Pavel NASTASE

English

Research Papers in Economics

Revista Informatica Economică, nr. 3 (43)/2007  56 
Risk Management for e-Business 
 
Floarea NASTASE, Bucharest, Romania, nastasef@ase.ro  
Pavel NASTASE, Bucharest, Romania, nastasep@ase.ro  
 
In the new Internet economy, risk management plays a critical role to protect the organiza-
tion and its ability to perform their business mission, not just its IT assets. Risk management 
is the process of identifying risk, assessing risk, and taking steps to reduce risk to an accept-
able level. The risk management is an important component of a IT security program. Infor-
mation and communications technology management and IT security are responsible for en-
suring that technology risks are managed appropriately. These risks originate from the de-
ployment and use of IT assets in various ways, such as configuring systems incorrectly or 
gaining access to restricted software. 
Key words: risk, e-business, threat, vulnerability. 
 
ntroduction  
Ri
given
sk is a function of the likelihood of a 
 threat-source’s exercising a particular 
potential vulnerability, and the resulting im-
pact of that adverse event on the organization 
(figure 1).  
 
 
Figure 1. Risk context [Source: ISO/IEC 15408-1 Common Criteria] 
 
Information assets are subject to many kinds 
of threats. Threats can occur from a direct or 
indirect source, can be from natural (envi-
ronmental) or human causes (either acciden-
tal or deliberate) and it may arise from within 
an organization or from outside. The impact 
caused by the unwanted incident may be of a 
temporary nature or it may be permanent. 
Vulnerabilities of the asset may be exploited 
and may lead to undesirable consequences 
affecting the confidentiality, integrity, avail-
ability, accountability, authenticity and/or re-
liability of information.  
The risk categories can help identify and as-
sess the risks, that are poorly managed or not 
mitigated represent an exposure to the health 
of the organization. The identification of the 
risk categories will help to consider where 
potential events might affect the achievement 
of e-business objectives. Typical risk catego-
ries include: external environment, opera-
tional, legal, information, regulatory, human 
resources, governance, financial, strategic 
and technology. 
 
Layered Risk Model   
Four levels of risk can be distinguished:  
•  Technical risk -  includes viruses, worms, 
I Revista Informatica Economică, nr. 3 (43)/2007  57
trojans, backdoors, and other malware as 
well as hacker attacks plus risks due to hard-
ware attacks. 
•  Individual risk - besides security, indi-
viduals greatly value their privacy, which is 
jeopardized by attacks such as phishing. 
Other individual risks result from fraud in e-
commerce, missing or wrong information, or 
data manipulation.  
•  Business risk -  for businesses, sales and 
reputation losses are major risks. Companies 
may never regain their full financial capacity 
after a computer downtime of several days, 
and even a company's existence can be 
threatened as a result of technical incidents. 
•  Societal risks - loss of privacy (“transpar-
ent user”), cyber-terrorism, and information 
warfare are key terms that outline the dangers 
on the societal level.  
They are interrelated and their occurrence is 
recursive. 
However, these risks can be identified and 
remediated by detecting vulnerabilities, as-
sessing their potential impact, and when war-
ranted, deploying corrective measures (figure 
2). Vulnerability management is the proc-
esses and technologies that an organization 
employs to identify, assess, and remediate IT 
vulnerabilities — weaknesses or exposures in 
IT assets or processes that may lead to a 
business risk (such as failure to maintain in-
tegrity of financial reporting or a loss of 
revenue or productivity) or security risk 
(such as violations of confidentiality, integ-
rity, or availability of data). 
Interface to other processes. The interfaces 
of risk management with other relevant secu-
rity and operational processes have to be 
identified, including product evaluations, In-
formation Security Management Systems 
(ISMS), security controls deployment, inci-
dent handling, business continuity planning 
and operational processes. 
 
 
 
Figure 2. Risk Management Process [Source: http://www.enisa.europa.eu] 
 
The Risk Management Process 
Definition of Scope. Process for the estab-
lishment of global parameters for the per-
formance of risk management within an or-
ganization. Within the definition of scope for 
risk management, both internal and external 
factors have to be taken into account. In or-
der to define an efficient framework for the 
management of risks it is important to: 
•  understand the background of the organi-
zation and its risks (e.g. its core processes, 
valuable assets, competitive areas etc.);  
•  evaluate the Risk Management activities 
being undertaken so far;  
•  develop a structure for the Risk Man-
agement initiatives and controls (counter-
measures, security controls etc.) to follow. 
 
Risk Assessment. A scientific and technologi-
cally based process consisting of three steps, 
risk identification, risk analysis and risk 
evaluation. Revista Informatica Economică, nr. 3 (43)/2007  58 
Risk Treatment. Process of selection and im-
plementation of measures to modify risk. Risk 
treatment measures can include avoiding, op-
timizing, transferring or retaining risk. 
Monitor and Review. A process for measur-
ing the efficiency and effectiveness of the or-
ganization’s risk management processes is 
the establishment of an ongoing monitor and 
review process. This process makes sure that 
the specified management action plans re-
main relevant and updated. This process also 
implements control activities including re-
evaluation of the scope and compliance with 
decisions. Continuous monitoring encom-
passes the processes that management puts in 
place to ensure that the policies, procedures, 
and business processes are operating effec-
tively. It addresses management’s responsi-
bility to assess the adequacy and effective-
ness of controls. This involves identifying the 
control objectives and assurance assertions 
and establishing automated tests to highlight 
transactions that fail to comply with the rele-
vant control objectives and assurance asser-
tions. Many of the techniques of continuous 
monitoring of controls by management are 
similar to those that may be performed in 
continuous auditing by the internal audit de-
partment. 
Risks Communication, Awareness & Con-
sulting. A process to exchange or share in-
formation about risk between the decision-
maker and other stakeholders inside and out-
side an organization. The information can re-
late to the existence, nature, form, probabil-
ity, severity, acceptability, treatment or other 
aspects of risk. 
Risk acceptance. Decision to accept a risk by 
the responsible management of the organiza-
tion. For each risk area, the options are to: 
reduce: lower the risk through controls, or 
technology; transfer: offload the risk by plac-
ing it on some other entity; accept: decide the 
risk is acceptable based on the benefit; ig-
nore: choose not to reduce, transfer or accept 
the risk - this is equivalent to accepting the 
risk, but without due diligence. 
Information and Communications Technol-
ogy (ICT) has become vastly important, but 
the consistent increase of security threats 
calls for an integrated, multivendor approach 
to security management. Figure 3 show ICT 
security incidents in European Enterprises 
that had an impact on the business, all or-
ganizations having experienced such an inci-
dent.  
New forms of security attacks constantly 
emerge, and organizations must address the 
business risks arising from these security is-
sues: viruses, worms, trojan horse, port scan-
ning, denial of service attacks, remote ad-
ministration, sniffers, spoofing, intrusion. 
 
Figure 3. ICT security incidents in European Enterprises [Source: e-Business W@tch] 
 
Standards and legislation 
Standards for risk analysis, security controls 
and management can significantly reduce the 
cost to enterprises of proper security policy 
implementation. Standardization here can re-
duce the decision load on management to ac-
ceptable levels for smaller enterprises. The 
adoption of standards by software and ser-
vice suppliers will increase competition and 
market size, reducing the cost of solutions to Revista Informatica Economică, nr. 3 (43)/2007  59
customer enterprises as economies of scale 
are passed on. 
The AS/NZS 4360 is the only internationally 
accepted risk management standard. The 
Standard provides a generic guide for estab-
lishing and implementing the risk manage-
ment process involving identification, analy-
sis, assessment, treatment and continuous 
risk monitoring. 
The  COBIT (Control Objectives for Infor-
mation and Related Technology) framework 
was released in 1996 and updated in 1998 
and 2000 by the Information Systems Audit 
and Control Foundation (ISACF) in response 
to the need for a reference framework for se-
curity and control in information technology. 
In 2000, the IT Governance Institute and IS-
ACF developed the Management Guidelines 
for COBIT. These guidelines respond to a 
need by Management for control and meas-
urability of IT, for the purpose of ensuring 
that IT activities achieve business objectives.  
The  COSO  (Committee of Sponsoring Or-
ganisations of the Treadway Commission) 
framework was developed to help manage-
ment better control their business activities. 
An internationally recognized standard, it 
provides a starting point for the individual 
assessment of internal control and applies a 
consistent approach to the review of business 
entities. Enterprise Risk Management (ERM) 
– Integrated Framework encourages internal 
auditors to approach their activities from the 
way management runs a business: control 
environment, risk assessment, information 
and communication, and risk monitoring.  
ISO 17799 (in full: ISO/IEC 17799:2005) is 
a risk management code of practice frame-
work for Information Systems security de-
veloped by the International Organization for 
Standardization.  
The  Sarbanes-Oxley Act of 2002 requires 
that SEC-registered annual reports need to 
contain an "Internal Control Report". 
Conclusions 
Risk management tools provide benefit to an 
organization through better understanding of 
the operational environment, improved moni-
toring of the effectiveness of controls and a 
more robust response to compliance auditors. 
There is the danger however that they detract 
from the skills and experience of the corpo-
rate Risk Managers and business unit manag-
ers. The use of these tools within an organi-
zation must be clearly understood and the 
roles and areas of responsibilities for the 
various individuals defined ensuring the out-
put is accurate and accepted. Like other secu-
rity controls, a risk management tool will not 
be effective unless it is used and maintained 
properly. It is worth spending the time at the 
outset to determine exactly what is needed 
and following the accepted approach for ap-
plication testing and procurement. This can 
be a major expense so the return on invest-
ment must be clearly demonstrated. This is 
only possible through a well-structured, well-
managed and well-understood process. 
References 
[1] Pauline Bowen, Joan Hash, Mark Wilson, 
Nadya Bartol, Gina Jamaldinian, Informa-
tion Security Handbook: A Guide for Man-
agers, NIST, 2006 
[2] NIST Special Publication 800-30, Risk 
Management Guide for Information Tech-
nology Systems, January 2002 
[3] Fl. Nastase, P. Nastase,  Security Con-
trols to Protect Information Systems, 2006, 
Proceedings of the 3rd International Confer-
ence - Economy and Transformation Man-
agement, Editura Universităţii de Vest, Timi-
şoara 
[4] P. Nastase, Fl. Nastase, R. Sova, IT Audit 
Trends within Framework of Balkan Coun-
tries, The Balkan Countries’ 1
st International 
Conference on Accounting and Auditing 
(BCAA), 8-9 March 2007, Edirne- Turkey 
[5] Buecker, J. Destro, Enterprise Security 
Architecture, 2006, IBM Redbooks  
[6] ***  http://www.isaca.org 
[7] *** http://www.enisa.europa.eu 
 

Risk Management for e-Business

Abstract

Similar works

Full text

Available Versions

Research Papers in Economics