Workshop: ISRM - Information Security Risk Management

Overview

Risk Management and Risk Assessment are the core processes for the establishment of security, both at operational and technical level:

Risk Management is the process of weighting policy alternatives by selecting appropriate prevention and control options. This definition holds true for variety of Risk Management solution, e.g. in the areas of corporate governance, information technology, critical infrastructure protection, environment, project management, etc.

Risk Assessment stands for the central process aiming at the technical and scientific identification, classification and mitigation of IT risks via the deployment of measures for the protection of IT-assets at risks (i.e. the .valuable assets of an organization). Various security standards and methodologies available, introduce such processes to cope with the quantification of the risk potential to which assets are exposed. At the same time, through the use of measurements and controls (also referred to as security measurements and security controls) these standards provide the tools for the establishment of the required assets protection. As Risk Assessment standards and methodologies are at a different level of abstraction, their use is subject to individual adaptations.

Apart from being fundamental for establishing and maintaining Information Security, Risk Management and Risk Assessment are essential elements of awareness raising. The risk posture of end users is prime success criterion of any campaign in the area of Information Security.

Within this Workshop we focus on all aspects of Risk Management and Risk Assessment in the area of Information Security. Additional aspects from areas of operations, process modeling and process integration will also be addressed.

Focus of the Workshop

The aim of this workshop is to raise contributions in existing and emerging areas of Risk Management and Risk Assessment both from industry and academia. Areas of interest include, but are not limited to:

Methods for the quantification of risks

Interoperability of Risk Management and Risk Assessment methods

Management issues/activities within Risk Management

Integration of Risk Management and Risk Assessment with other operational processes

Identification of emerging risks

Method adaptations and best practices in Risk Management and Risk Assessment and their application

Technical issues in Risk Management

Legal requirements and Risk Management

Awareness raising and Risk Management, Risk Assessment

Novell methods and tools for Risk Management and Risk Assessment

Sector standards in Risk Management and Risk Assessment

Papers ranging from best practices to actual research results in Risk Management/Risk Assessment will be welcome. Particular attention will be paid to contributions related to Small and Medium Enterprises (SMEs) as well as to emerging research coping with scientific work in this area.

Important dates

Submission of papers: 6 January 2006 - Extension: 18 January 2006
Notification of acceptance: 20 January 2006
Camera ready copies: 10 February 2006

Workshop Chairs:

Professor Dr. D. Karagiannis, University of Vienna, Austria

Dr. L. Marinos, ENISA, Greece

Programme Committee

M. Dietrich, BSG Unternehmensberatung, Switzerland

M. Hoevers, ECP-NL, Platform voor eNetherland, The Netherland

K. Kalmelid, Swedish Emergency Management Agency, Sweden

S. Lebel, Dir. Centrale de la Sécurité des Systèmes d'information, France

Prof. Dr. G. Müller, Telematik, Univ. of Feiburg, Germany

M. Rohde, European Commission, DG Information Society and Media, Belgium

Dr. I. Schaumüller-Bichl, IT Security Consultant, Austria