Risk Theories

Risk Theories
1

Information Security and Risk Management Theories
William Butler

Risk Theories
2
Information Security and Risk Management Theory
Leaders use risk management framework to describe an organizations risk management
process (Jones, 2007). There are risk management models from which organizational leaders
can choose to base their risk management framework upon. All of the risk management models
are based on one of several risk management theories. Bojanc (2008) presented a risk
management model based on game theory. Fehle (2005) presented a risk management model
based and dynamic risk management theory. Li (2007) presented a risk management model
based on real option theory.
Bojanc (2008) stated that security solutions are complex (hardware, software, service) to
cost and traditional costing methods such as (average rate of return (ARR), payback period
(PBP), net present value (NPV), internal rate of return (IRR)) individually are not adequate. The
risk management models provide organizational leadership with a framework to evaluate
investment options and support decisions. Organizations have limited budgets and resources to
invest in controls and protective measures and leaders must make informed decisions. Each of
the risk management theories presented by (Bojanc, 2008; Fehle, 2005; Li, 2007) pose a unique
set of costs and benefits to the organizational leadership applying them.
Risk Management Theories
Several information risk theories are game theory (Bojanc, 2008) and (Cox, 2009),
dynamic risk management theory (Fehle, 2005) and real option theory (Li, 2007). The risk
theories are the basis of major risk management models presented by (Bojanc, 2008; Fehle,
2005; Li, 2007). Each risk theory offers organizational leadership a different framework to
quantify the investment in controls and to evaluate options or alternatives.
Game Theory

Risk Theories
3
The Bojanc (2008) risk management model concluded with the...