Implications for Risk and Security Management

---

For effective RSM the following key approaches should be adopted because of associated significant benefits.

Stakeholders Participation

RSM is often seen solely as the domain of IT professionals with security being viewed from a technological aspects, i.e., implementing technological measures such as firewalls and encryption. Kelly (1999) refers to this practice as 'point solutions'-quick fixes that can do more harm than good. Management and users appear rarely involved in the process. With the increasing integration of all business activities, as occurs with e-commerce, stakeholders from all areas of the organisation need to be involved. In this way a balanced set of risk and security measures will be adopted that includes technology, people and procedures.

Holistic

'Many security problems are caused by all too human misperceptions of where dangers actually lie and the ability of particular measures to avoid them' (Brewer, 1999). The levels of security understanding of security threats, exposures, safeguards, practices and priorities among information users and solution providers varies widely. RSM therefore needs to be approached in a systematic manner so that all perceptions are included and evaluated. By capturing a wide variety of opinions, all facets of RSM will be implemented.

Competitive Advantage

RSM activities are seen as burdensome practices that create additional work for already stretched resources. They are often perceived to be only needed when the organisation is under attack or special circumstances arise. This negative perception needs to be reversed and RSM should be seen as an enabler since, by operating safely, the organisation can takemore risks than its competitors. Furthermore, RSM has the obvious advantage of preventing expensive system outages, thereby ensuring the continued viability of the organisation.

---