DefinePK

Abstract

Identifying potential information security risk is a challenging task. This is due to the evolution of Information Communication Technology in daily business which may introduce possible digital threats. Many studies have attempted to develop risk analysis tools, yet it is unable to produce the best factors for information security threats. Failure in identifying various types of information security risks will affect the development of effective countermeasure. It has been highlighted in many studies that conventional techniques used to analyze risks can be divided into two categories known as quantitative and qualitative methods. The limitation of the tools introduced in previous research which provide insufficient information may consequently contribute to threat in information security. In addition, the rapid growth of the Internet technology may also increase possible threats to information security. The main focus of this study is to compare the risk analysis tools available in the market, identify their method and summarize their factors. A comparative analysis covers performance of analysis and security services. The result shows that current information security risk analysis tools introduced various types of risk factors. None of the tools however can consider qualitative and quantitative data in parallel. It is believed that qualitative information could increase the dimension of risk factors and produce better accuracy in the analysis. Further investigation is highly required to solve the outlined issue. This paper describes different approaches in several risk analysis tools, which methods are used in different steps and presents the risk factors identified by previous selections of studies.