Computationally Supported Quantitative Risk Management for Information Systems

Networked information systems have been a reality in organizations for more than a decade. In addition, these systems are now the key element not only of organization-wide information systems, but also of national and international infrastructures ranging from power plants to air-control systems. These networked information systems, which are basically built around the Internet, are therefore very sensitive to any kind of malfunctioning, so their security is of central concern. However, ensuring their security requires proper risk management which, in the case of such systems, has certain specifics. For this reason traditional risk management methods cannot be applied directly. The analysis of this field presented in this chapter is extended by a new approach to further support decision making in this complex area. The approach is based on a generic model for risk management in contemporary distributed information systems and provides the basis for computational tools for quantitative treatment of risk management in information systems. Through modeling it provides new possibilities for improved decision making under uncertainty, by addressing not only reactive, but also active approaches to risk management. In addition, it also enables simulations for supporting pro-active risk management approaches.