Calculating E-Risk

Computerworld - Even with strong security, e-business risk is a fact of life in today's interconnected business world. But the fundamental problem with managing this new form of business risk, say IT managers, is that there are no metrics and no standards to measure the level of risk.

Nevertheless, your board of directors needs to see that those bits and bytes they call "just data" are really the corporation's lifeblood. And they must get their arms around the ultimate cost to the business if that data were lost, stolen or altered.

"We need to make a model where e-business risk is wrapped in the cost of doing business—like automobiles [that] transfer regulatory costs to the consumers," says Frank Reeder, who chairs both the computer system security and privacy advisory board at the U.S. Department of Commerce and the Center for Internet Security in Bethesda, Md.

But quantifying risk calls for statistics and benchmarks, things that are sorely lacking in this new era of e-business, says Paul Raines, head of global information risk management at Barclay's Capital, the investment division of Barclay's Group PLC in London.

"Most risk models so far have been qualitative: Define your assets by classifying your data sensitivity; define your risks [for] theft, disaster, hacking. Then you evaluate your site against these risks," Raines says. "To develop a quantitative model, you need data to determine chance and frequency. The problem is, there hasn't been historical data to draw from. The equivalent of actuarial tables will help."

	How Insurers View Risk Insurance companies look at these factors, among others, to assess e-business risk: Electronic publishing liability Property damage Business interruption Damage to reputation Restoration costs Intellectual property loss Business income loss Extortion SOURCE: the Fidelity and Deposit Cos., Baltimore; American International Group Inc., New York

For starters, regulators and standards bodies are developing best practice guidelines for information security, a crucial first step in building a framework for metrics. Insurers are selling e-business security and liability insurance, so they're already attaching a price to some risks. Private incident-response centers are gathering and publishing statistical data on the frequency of certain events that could expose risk. And internal auditors are beginning to define e-business risk for their boards of directors.