{"id":"https://openalex.org/W154279265","doi":"https://doi.org/10.17705/1cais.02822","title":"Information Security Risk Management: In Which Security Solutions Is It Worth Investing?","display_name":"Information Security Risk Management: In Which Security Solutions Is It Worth Investing?","publication_year":2011,"publication_date":"2011-01-01","ids":{"openalex":"https://openalex.org/W154279265","doi":"https://doi.org/10.17705/1cais.02822","mag":"154279265"},"language":"en","primary_location":{"id":"doi:10.17705/1cais.02822","doi":"https://doi.org/10.17705/1cais.02822","is_oa":true,"landing_page_url":"https://doi.org/10.17705/1cais.02822","pdf_url":"https://aisel.aisnet.org/cgi/viewcontent.cgi?article=3593&context=cais","source":{"id":"https://openalex.org/S4210239688","display_name":"Communications of the Association for Information Systems","issn_l":"1529-3181","issn":["1529-3181"],"is_oa":false,"is_in_doaj":false,"is_core":true,"listed_in":["abdc-a","anvur-class-a","anvur-scientific","cwts-core","dongbi-d","fnege-3","jufo-2","norway-1","poland-70","russia-white-list-2"],"host_organization":"https://openalex.org/P4310321080","host_organization_name":"Association for Information Systems","host_organization_lineage":["https://openalex.org/P4310321080"],"host_organization_lineage_names":["Association for Information Systems"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Communications of the Association for Information Systems","raw_type":"journal-article"},"volume":null,"type":"article","is_traditional":true,"indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"bronze","oa_url":"https://aisel.aisnet.org/cgi/viewcontent.cgi?article=3593&context=cais","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5001374797","display_name":"Stefan Fenz","orcid":"https://orcid.org/0000-0002-2880-1526","observed_orcids":["https://orcid.org/0000-0002-2880-1526"]},"institutions":[{"id":"https://openalex.org/I145847075","display_name":"TU Wien","ror":"https://ror.org/04d836q62","country_code":"AT","type":"education","lineage":["https://openalex.org/I145847075"]}],"countries":["AT"],"is_corresponding":false,"raw_author_name":"Stefan Fenz","raw_affiliation_strings":["Vienna University of Technology, Austria","Vienna University of Technology"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Vienna University of Technology, Austria","institution_ids":["https://openalex.org/I145847075"]},{"raw_affiliation_string":"Vienna University of Technology","institution_ids":["https://openalex.org/I145847075"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5035676027","display_name":"Andreas Ekelhart","orcid":"https://orcid.org/0000-0003-3682-1364","observed_orcids":["https://orcid.org/0000-0003-3682-1364"]},"institutions":[{"id":"https://openalex.org/I4210167190","display_name":"SBA Research","ror":"https://ror.org/05nny6x17","country_code":"AT","type":"facility","lineage":["https://openalex.org/I4210167190"]}],"countries":["AT"],"is_corresponding":false,"raw_author_name":"Andreas Ekelhart","raw_affiliation_strings":["SBA Research, Austria","Association for Information Systems"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"SBA Research, Austria","institution_ids":["https://openalex.org/I4210167190"]},{"raw_affiliation_string":"Association for Information Systems","institution_ids":[]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5082152072","display_name":"Thomas Neubauer","orcid":"https://orcid.org/0000-0002-9814-6045","observed_orcids":["https://orcid.org/0000-0002-9814-6045"]},"institutions":[{"id":"https://openalex.org/I145847075","display_name":"TU Wien","ror":"https://ror.org/04d836q62","country_code":"AT","type":"education","lineage":["https://openalex.org/I145847075"]}],"countries":["AT"],"is_corresponding":false,"raw_author_name":"Thomas Neubauer","raw_affiliation_strings":["Vienna University of Technology, Austria","Vienna University of Technology"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Vienna University of Technology, Austria","institution_ids":["https://openalex.org/I145847075"]},{"raw_affiliation_string":"Vienna University of Technology","institution_ids":["https://openalex.org/I145847075"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":6.0146,"has_fulltext":true,"cited_by_count":46,"citation_normalized_percentile":{"value":0.95757665,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":87,"max":98},"biblio":{"volume":"28","issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9976000189781189,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9976000189781189,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11572","display_name":"Information Technology Governance and Strategy","score":0.0019000000320374966,"subfield":{"id":"https://openalex.org/subfields/1404","display_name":"Management Information Systems"},"field":{"id":"https://openalex.org/fields/14","display_name":"Business, Management and Accounting"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/information-security-risk-management","display_name":"information security risk management","score":0.9980000257492065},{"id":"https://openalex.org/keywords/risk-assessment","display_name":"risk assessment","score":0.9129999876022339},{"id":"https://openalex.org/keywords/risk-reduction","display_name":"risk mitigation","score":0.996999979019165},{"id":"https://openalex.org/keywords/investment-efficiency","display_name":"investment efficiency","score":0.5630000233650208},{"id":"https://openalex.org/keywords/management-decision-support","display_name":"management decision support","score":0.625}],"concepts":[{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.636599600315094},{"id":"https://openalex.org/C32896092","wikidata":"https://www.wikidata.org/wiki/Q189447","display_name":"Risk management","level":2,"score":0.6060408353805542},{"id":"https://openalex.org/C148976360","wikidata":"https://www.wikidata.org/wiki/Q1662500","display_name":"Information security management","level":5,"score":0.5559341907501221},{"id":"https://openalex.org/C103377522","wikidata":"https://www.wikidata.org/wiki/Q3493999","display_name":"Security information and event management","level":4,"score":0.5488019585609436},{"id":"https://openalex.org/C136197465","wikidata":"https://www.wikidata.org/wiki/Q1729295","display_name":"Variety (cybernetics)","level":2,"score":0.5366572141647339},{"id":"https://openalex.org/C83163435","wikidata":"https://www.wikidata.org/wiki/Q3954104","display_name":"Security management","level":2,"score":0.5278903245925903},{"id":"https://openalex.org/C527648132","wikidata":"https://www.wikidata.org/wiki/Q189900","display_name":"Information security","level":2,"score":0.5136677622795105},{"id":"https://openalex.org/C18762648","wikidata":"https://www.wikidata.org/wiki/Q42213","display_name":"Work (physics)","level":2,"score":0.5071496963500977},{"id":"https://openalex.org/C95609273","wikidata":"https://www.wikidata.org/wiki/Q5975208","display_name":"IT risk management","level":3,"score":0.4833914339542389},{"id":"https://openalex.org/C27548731","wikidata":"https://www.wikidata.org/wiki/Q88272","display_name":"Investment (military)","level":3,"score":0.4481562077999115},{"id":"https://openalex.org/C144133560","wikidata":"https://www.wikidata.org/wiki/Q4830453","display_name":"Business","level":0,"score":0.4265226721763611},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.4190221428871155},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.33627039194107056},{"id":"https://openalex.org/C184842701","wikidata":"https://www.wikidata.org/wiki/Q370563","display_name":"Cloud computing security","level":3,"score":0.27559441328048706},{"id":"https://openalex.org/C10138342","wikidata":"https://www.wikidata.org/wiki/Q43015","display_name":"Finance","level":1,"score":0.22190165519714355},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.12369498610496521},{"id":"https://openalex.org/C79974875","wikidata":"https://www.wikidata.org/wiki/Q483639","display_name":"Cloud computing","level":2,"score":0.08518597483634949},{"id":"https://openalex.org/C78519656","wikidata":"https://www.wikidata.org/wiki/Q101333","display_name":"Mechanical engineering","level":1,"score":0.0},{"id":"https://openalex.org/C94625758","wikidata":"https://www.wikidata.org/wiki/Q7163","display_name":"Politics","level":2,"score":0.0},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.0},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.0},{"id":"https://openalex.org/C199539241","wikidata":"https://www.wikidata.org/wiki/Q7748","display_name":"Law","level":1,"score":0.0},{"id":"https://openalex.org/C17744445","wikidata":"https://www.wikidata.org/wiki/Q36442","display_name":"Political science","level":0,"score":0.0}],"mesh":[],"locations_count":3,"locations":[{"id":"doi:10.17705/1cais.02822","doi":"https://doi.org/10.17705/1cais.02822","is_oa":true,"landing_page_url":"https://doi.org/10.17705/1cais.02822","pdf_url":"https://aisel.aisnet.org/cgi/viewcontent.cgi?article=3593&context=cais","source":{"id":"https://openalex.org/S4210239688","display_name":"Communications of the Association for Information Systems","issn_l":"1529-3181","issn":["1529-3181"],"is_oa":false,"is_in_doaj":false,"is_core":true,"listed_in":["abdc-a","anvur-class-a","anvur-scientific","cwts-core","dongbi-d","fnege-3","jufo-2","norway-1","poland-70","russia-white-list-2"],"host_organization":"https://openalex.org/P4310321080","host_organization_name":"Association for Information Systems","host_organization_lineage":["https://openalex.org/P4310321080"],"host_organization_lineage_names":["Association for Information Systems"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Communications of the Association for Information Systems","raw_type":"journal-article"},{"id":"pmh:oai:CiteSeerX.psu:10.1.1.372.8467","doi":null,"is_oa":false,"landing_page_url":"http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.372.8467","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"http://www.sba-research.org/wp-content/uploads/publications/2011 - Fenz - Information Security Risk Management In Which Security Solutions Is It Worth Investing.pdf","raw_type":"text"},{"id":"pmh:oai:aisel.aisnet.org:cais-3593","doi":null,"is_oa":false,"landing_page_url":"https://aisel.aisnet.org/cais/vol28/iss1/22","pdf_url":null,"source":{"id":"https://openalex.org/S30879505","display_name":"Journal of the Association for Information Systems","issn_l":"1536-9323","issn":["1536-9323"],"is_oa":false,"is_in_doaj":false,"is_core":true,"listed_in":["abdc-a-star","anvur-scientific","cwts-core","dongbi-a","fnege-1","jufo-3","norway-2","poland-140","russia-white-list-1","vabb-shw"],"host_organization":"https://openalex.org/P4310321080","host_organization_name":"Association for Information Systems","host_organization_lineage":["https://openalex.org/P4310321080"],"host_organization_lineage_names":["Association for Information Systems"],"type":"journal"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Communications of the Association for Information Systems","raw_type":"text"}],"best_oa_location":{"id":"doi:10.17705/1cais.02822","doi":"https://doi.org/10.17705/1cais.02822","is_oa":true,"landing_page_url":"https://doi.org/10.17705/1cais.02822","pdf_url":"https://aisel.aisnet.org/cgi/viewcontent.cgi?article=3593&context=cais","source":{"id":"https://openalex.org/S4210239688","display_name":"Communications of the Association for Information Systems","issn_l":"1529-3181","issn":["1529-3181"],"is_oa":false,"is_in_doaj":false,"is_core":true,"listed_in":["abdc-a","anvur-class-a","anvur-scientific","cwts-core","dongbi-d","fnege-3","jufo-2","norway-1","poland-70","russia-white-list-2"],"host_organization":"https://openalex.org/P4310321080","host_organization_name":"Association for Information Systems","host_organization_lineage":["https://openalex.org/P4310321080"],"host_organization_lineage_names":["Association for Information Systems"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Communications of the Association for Information Systems","raw_type":"journal-article"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[{"id":"https://openalex.org/F4320329167","display_name":"SBA Research","ror":"https://ror.org/05nny6x17"}],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W154279265.pdf","grobid_xml":"https://content.openalex.org/works/W154279265.grobid-xml"},"referenced_works_count":64,"referenced_works":["https://openalex.org/W110993677","https://openalex.org/W1501321335","https://openalex.org/W1539018342","https://openalex.org/W1539259953","https://openalex.org/W1549342539","https://openalex.org/W1555628483","https://openalex.org/W1576423955","https://openalex.org/W1587049735","https://openalex.org/W1808818536","https://openalex.org/W1839016339","https://openalex.org/W1963635584","https://openalex.org/W1979109411","https://openalex.org/W1980647631","https://openalex.org/W1995496153","https://openalex.org/W2006253146","https://openalex.org/W2010130012","https://openalex.org/W2010507002","https://openalex.org/W2028907687","https://openalex.org/W2030684361","https://openalex.org/W2049561176","https://openalex.org/W2052086751","https://openalex.org/W2056075452","https://openalex.org/W2069034951","https://openalex.org/W2069446501","https://openalex.org/W2069452717","https://openalex.org/W2072285937","https://openalex.org/W2095519402","https://openalex.org/W2107966619","https://openalex.org/W2113843354","https://openalex.org/W2118345908","https://openalex.org/W2118376079","https://openalex.org/W2119587968","https://openalex.org/W2120845620","https://openalex.org/W2121697735","https://openalex.org/W2132581322","https://openalex.org/W2143598966","https://openalex.org/W2145071552","https://openalex.org/W2164026556","https://openalex.org/W2167474990","https://openalex.org/W2171113940","https://openalex.org/W2339802317","https://openalex.org/W2369295637","https://openalex.org/W2626788661","https://openalex.org/W2796585648","https://openalex.org/W2914007910","https://openalex.org/W2917161115","https://openalex.org/W3147477526","https://openalex.org/W3149001482","https://openalex.org/W4300059635","https://openalex.org/W4301248776","https://openalex.org/W6600371876","https://openalex.org/W6600737549","https://openalex.org/W6601817330","https://openalex.org/W6603129184","https://openalex.org/W6603174688","https://openalex.org/W6607151510","https://openalex.org/W6608125156","https://openalex.org/W6608148874","https://openalex.org/W6609021830","https://openalex.org/W6629081678","https://openalex.org/W6631958567","https://openalex.org/W6826619929","https://openalex.org/W6832644000","https://openalex.org/W6837461704"],"related_works":["https://openalex.org/W7095208000","https://openalex.org/W2157491451","https://openalex.org/W2069700160","https://openalex.org/W2098802318","https://openalex.org/W2259258939","https://openalex.org/W2800557244","https://openalex.org/W2014071948","https://openalex.org/W1964497422","https://openalex.org/W4248740065","https://openalex.org/W1998200814"],"abstract_inverted_index":{"As":[0],"companies":[1],"are":[2,11,58],"increasingly":[3],"exposed":[4],"to":[5,14,17,127],"information":[6],"security":[7,18,21,30,81],"threats,":[8],"decision":[9,47,90],"makers":[10,48,91],"permanently":[12],"forced":[13],"pay":[15],"attention":[16],"issues.":[19],"Information":[20],"risk":[22,32,34,37],"management":[23,89],"provides":[24],"an":[25],"approach":[26],"for":[27,60,88],"measuring":[28],"the":[29,79,100,106,120],"through":[31],"assessment,":[33],"mitigation,":[35],"and":[36,71,103],"evaluation.":[38],"Although":[39],"a":[40,86,109],"variety":[41],"of":[42,78,105,122],"approaches":[43],"have":[44],"been":[45],"proposed,":[46],"lack":[49],"well-founded":[50],"techniques":[51],"that":[52,92],"(1)":[53],"show":[54,64,119],"them":[55,65],"what":[56],"they":[57],"getting":[59],"their":[61,67],"investment,":[62],"(2)":[63],"if":[66],"investment":[68],"is":[69],"efficient,":[70],"(3)":[72],"do":[73],"not":[74],"demand":[75],"in-depth":[76],"knowledge":[77],"IT":[80],"domain.":[82],"This":[83,97],"article":[84],"defines":[85],"methodology":[87,107,124],"effectively":[93],"addresses":[94],"these":[95],"problems.":[96],"work":[98],"involves":[99],"conception,":[101],"design,":[102],"implementation":[104],"into":[108],"software":[110],"solution.":[111],"The":[112],"results":[113],"from":[114],"two":[115],"qualitative":[116],"case":[117],"studies":[118],"advantages":[121],"this":[123],"in":[125],"comparison":[126],"established":[128],"methodologies.":[129]},"counts_by_year":[{"year":2025,"cited_by_count":1},{"year":2023,"cited_by_count":4},{"year":2022,"cited_by_count":3},{"year":2021,"cited_by_count":1},{"year":2020,"cited_by_count":3},{"year":2019,"cited_by_count":4},{"year":2018,"cited_by_count":5},{"year":2017,"cited_by_count":3},{"year":2016,"cited_by_count":5},{"year":2015,"cited_by_count":6},{"year":2014,"cited_by_count":3},{"year":2013,"cited_by_count":2},{"year":2012,"cited_by_count":5}],"updated_date":"2026-11-04T10:54:05.112534","created_date":"2016-06-24T00:00:00"}