Upravljanje rizicima informacijskih sustava

master's thesis

• Title (english): Information System Risk Management
• Author: David Bartol
• Mentor: Mario Spremić (mentor)
• Committee member: Mario Spremić (predsjednik povjerenstva)
• Committee member: Ivan Strugar (član povjerenstva)
• Committee member: Božidar Jaković (član povjerenstva)
• Granter: University of Zagreb; Faculty of Economics and Business; (Department of Informatics); Zagreb
• Defense date and country: 2019-09-25, Croatia
• Scientific / art field, discipline and subdiscipline: SOCIAL SCIENCES; Economics; Business Informatics

Abstract

Nesigurnosti današnje poslovne okoline rezultirali su s velikim financijskim gubicima koje su zadesile i najveće kompanije na svijetu. Radi toga kompanije su počele primjenjivati primitivan oblik upravljanja rizicima tzv. „silos upravljanje rizicima“ („Traditional Risk Management“). Problem ovakvog pristupa proizlazi iz činjenice da se rizici gledaju kao pojedinačni problemi (izolirani), bez razmišljanja kako pojedini rizik utječe na kompaniju. Kao rješenje na taj problem osmišljen je okvir za sustavno upravljanje rizicima (ERM). Fokus ovog rada biti će objašnjenje sustava za upravljanje rizicima (ERM) te njegove primjene kod upravljanja kibernetičkim rizicima. Pomoću ERM – a te na primjeru Red Hat Inc. kompanije prikazati će se metodologija identifikacije (SWOT, PEST i analiza financijskih podataka), procjene (analiza scenarija) i prioritizacija rizika (mapa rizika i preporuka). Provedenim istraživanjem identificirano je devet ključnih rizika koji su ušli u opseg analize. Rezultati istraživanja potvrdili su prednosti korištenja okvira za sustavno upravljanje rizicima (ERM), ali isto tako i neke njegove nedostatke, koji se u određenim situacijama mogu minimalizirati dodatnim korištenjem ISO 31000 I NIST-a.

Abstract (english)

The insecurities of today's business environment have resulted in huge financial losses that have hit even the largest companies in the world. Because of this, companies have started to apply primitive forms of risk management, the so-called silo – based risk management ("Traditional Risk Management"). The problem with this approach stems from the fact that risks are viewed as individual problems, isolated, without thinking how individual risks affect the company. A systematic risk management (ERM) framework is designed to address this problem. The focus of this paper will be on explaining the risk management system (ERM) and its application in cyber risk management. With it (ERM), and by using the example of Red Hat Inc., the methodology for identification (SWOT, PEST and financial data analysis), assessments (scenario analysis) and risk prioritization (risk map and recommendations) will be presented. The conducted research identified nine key risks that have fallen into the scope of the analysis. The research results confirmed the benefits of using a systematic risk management (ERM) framework, but also some of its disadvantages, which can, in certain circumstances, be minimized by the additional use of ISO 31000 I NIST.

• Keywords: Kibernetička sigurnost; Okvir za sustavno upravljanje rizicima (ERM); Revizija informacijskih sustava; Mapa rizika
• Keywords (english): Cybersecurity; Enterprise Risk Management (ERM); Information Systems Audit; Risk Map
• Language: croatian
• URN:NBN: urn:nbn:hr:148:071603
• Study programme: Title: Business Economics; Study programme type: university; Study level: graduate; Academic / professional title: magistar/magistra ekonomije (magistar/magistra ekonomije)
• Type of resource: Text
• File origin: Born digital
• Access conditions: Closed access
• Created on: 2019-09-26 09:05:31