Introduction In every working area, assets are exposed to risk of various harms. In the information technology area, there is risk of damaging or losing resources. Risk assessment is a process that determines what information resources require protection, and it documents potential risks from IT security failures that may cause loss of information confidentiality, integrity, or availability. The purpose of risk assessment is to help management create appropriate strategies and controls for the steering of information assets (BSI Standard 100-1,2,3), (ENISA Regulation). IT resources are tangible assets (such as hardware, equipment, buildings), data, documents, software, users, and intangible resources (reputation, confidence, etc.) Management of the information system (IS) is a component of the company management and makes its inherent part. The planning of the continuity of IS operation and development must be entirely coordinated with the same activities on the company level. Both short-term and long-term strategies must be harmonized within the framework of business, development, changes, and planning. Risk management and its maintenance on an acceptable level is part of the work process and its development. Its basic characteristic must be continuity (Nikolic, 2007). The chosen acceptable risk level after the implementation of particular measures also means a decision on balance referring to costs concerning the achievement of the selected risk level and benefits, i.e., profit of the company. Methodology The methodology of risk assessment implies recognized procedure (Macdonald, 2004), detailed system description, identification of hazards, defining causes of emphasized hazards, risk assessment, measures for risk reduction and mitigation, risk reassessment according to remaining hazards, and conducting measures for maintaining risk at an accepted level. Figure 1 displays the methodology of risk assessment with elements of the risk management system. Risk assessment in the IT area can be conducted by way of various methods. We use the method established and developed by our expert team (Nikolic & Laban 2008). The method was created for the occupational health and safety area, and is successfully applied in the IT area as described in Nikolic and Ruzic-Dimitrijevic (2009). This method enables the achievement of one of the main goals of risk assessment: risk assessment for every employee, workplace, and work environment, i.e., the assessment of all risks. The work environment can be a company, building, floor, or office. It can also be a plant, building site, park, field, or any system, as well as an information system and its components, such as hardware, communication equipment (network), and system software. The workplace in an information system is application software with data as final products, and it can be considered in the same way as in the occupational health and safety area. IT resources are buildings, hardware, communication equipment, software, data, and, of course, people who take part in IT processes. Risk assessment is carried out on more levels (items in the work environment). Software also has several levels--environmental software, operating system, program supported application, and finally a single application--as well as the data used and gained in application executing. Risk assessment of each level involves conducting appropriate protective measures in order to obtain the layered protection. Therefore, the risk assessment of an information system (IS) is conducted through the risk assessment of every application and through the evaluation of the system's state. Risk identification involves the knowledge about the organization (internal and external), as well as earlier experiences about risk issues. The evaluation of risk classifies risk in certain categories (quantitative and/or qualitative) according to which adequate measures are carried out. …
Read more