IT Risk Management

Contacts: Stephan Schmidt, Seyit Ahmet Camtepe


Risk management and business process management play an increasingly vital role in contemporary corporate infrastructures due to a multitude of operational, technical and regulatory reasons. Increasingly complex interdependencies as well as flexibility demands in rapidly changing networked environments make this effect even more pronounced for companies that rely heavily on IT infrastructure. Current risk management methodologies are static and mostly qualitative in nature, is not able to predict cascading effects and thus can not meet the demands of operational practices.

The IT Risk Management research area aims to develop a quantitative framework for corporate IT risk management with the explicit goal of understanding and capturing the complex interdependencies present in modern networked IT infrastructures. The underlying risk management process splits into three phases. The risk assessment phase quantifies asset values at a high level (business processes and services) and threats at a low level of abstraction (hardware). Augmented by interdependency analysis rooted in graph theory and Bayesian networks, these values are correlated at the hardware level where tactical risk mitigation strategies are available. Theoretically optimal and scalable risk mitigation strategies based on game and control theory as well as Markov Decision Processes (MDPs) are applied in the risk mitigation phase which minimize the total risk over a given finite time horizon utilizing a given security budget. For the final risk transfer phase, we aim to develop strategies for redesigning corporate IT infrastructure based on high-risk interdependencies identified in the previous phase. In all phases, in particular in the mitigation phase, algorithms developed in other CC SEC research areas such as Collaborative Security or Network and Security Simulation can be applied within the developed framework as long as they support the asset and discrete-event model.