Copy the page URI to the clipboard
Crotty, James and Daniel, Elizabeth
(2023).
DOI: https://doi.org/10.1108/ACI-07-2022-0178
Abstract
Purpose - Consumers increasingly rely on organisations for online services and data storage while these same institutions seek to digitise the information assets they hold to create economic value. Cybersecurity failures arising from malicious or accidental actions can lead to significant reputational and financial loss which organisations must guard against. Despite having some critical weaknesses, qualitative cybersecurity risk analysis is widely used in developing cybersecurity plans. This research explores these weaknesses, considers how quantitative methods might address the constraints, and seeks the insights and recommendations of leading cybersecurity practitioners on the use of qualitative and quantitative cyber risk assessment methods.
Design/methodology/approach - The study is based upon a literature review and thematic analysis of in-depth qualitative interviews with 16 senior cybersecurity practitioners representing financial services and advisory companies from across the world.
Findings - While most organisations continue to rely on qualitative methods for cybersecurity risk assessment, some are also actively using quantitative approaches to enhance their cybersecurity planning efforts. The recommendation of this paper is that organisations should adopt both a qualitative and quantitative cyber risk assessment approach.
Originality/value - This work provides the first insight into how senior practitioners are using and combining qualitative and quantitative cybersecurity risk assessment, and highlights the need for in-depth comparisons of these two different approaches.
CORE (COnnecting REpositories)
CORE (COnnecting REpositories)
