Information Security Risk Management: An Intelligence-Driven Approach


  • Jeb Webb University of Melbourne
  • Sean Maynard University of Melbourne
  • Atif Ahmad University of Melbourne
  • Graeme Shanks University of Melbourne



Information, Security, Risk Management, Enterprise Situation Awareness, Intelligence


Three deficiencies exist in the organisational practice of information security risk management: risk assessments are commonly perfunctory, security risks are estimated without investigation; risk is assessed on an occasional (as opposed to continuous) basis. These tendencies indicate that important data is being missed and that the situation awareness of decision-makers in many organisations is currently inadequate. This research-in-progress paper uses Endsley's situation awareness theory, and examines how the structure and functions of the US national security intelligence enterprise—a revelatory case of enterprise situation awareness development in security and risk management—correspond with Endsley’s theoretical model, and how facets of the US enterprise might be adapted to improve situation awareness in the information security risk management process of organisations.




How to Cite

Webb, J., Maynard, S., Ahmad, A., & Shanks, G. (2014). Information Security Risk Management: An Intelligence-Driven Approach. Australasian Journal of Information Systems, 18(3).



Selected Papers from the Australasian Conference on Information Systems (ACIS)