\documentclass[11pt,twoside]{article}\makeatletter

\IfFileExists{xcolor.sty}%
  {\RequirePackage{xcolor}}%
  {\RequirePackage{color}}
\usepackage{colortbl}
\usepackage{wrapfig}
\usepackage{ifxetex}
\ifxetex
  \usepackage{fontspec}
  \usepackage{xunicode}
  \catcode`⃥=\active \def⃥{\textbackslash}
  \catcode`❴=\active \def❴{\{}
  \catcode`❵=\active \def❵{\}}
  \def\textJapanese{\fontspec{Noto Sans CJK JP}}
  \def\textChinese{\fontspec{Noto Sans CJK SC}}
  \def\textKorean{\fontspec{Noto Sans CJK KR}}
  \setmonofont{DejaVu Sans Mono}
  
\else
  \IfFileExists{utf8x.def}%
   {\usepackage[utf8x]{inputenc}
      \PrerenderUnicode{–}
    }%
   {\usepackage[utf8]{inputenc}}
  \usepackage[english]{babel}
  \usepackage[T1]{fontenc}
  \usepackage{float}
  \usepackage[]{ucs}
  \uc@dclc{8421}{default}{\textbackslash }
  \uc@dclc{10100}{default}{\{}
  \uc@dclc{10101}{default}{\}}
  \uc@dclc{8491}{default}{\AA{}}
  \uc@dclc{8239}{default}{\,}
  \uc@dclc{20154}{default}{ }
  \uc@dclc{10148}{default}{>}
  \def\textschwa{\rotatebox{-90}{e}}
  \def\textJapanese{}
  \def\textChinese{}
  \IfFileExists{tipa.sty}{\usepackage{tipa}}{}
\fi
\def\exampleFont{\ttfamily\small}
\DeclareTextSymbol{\textpi}{OML}{25}
\usepackage{relsize}
\RequirePackage{array}
\def\@testpach{\@chclass
 \ifnum \@lastchclass=6 \@ne \@chnum \@ne \else
  \ifnum \@lastchclass=7 5 \else
   \ifnum \@lastchclass=8 \tw@ \else
    \ifnum \@lastchclass=9 \thr@@
   \else \z@
   \ifnum \@lastchclass = 10 \else
   \edef\@nextchar{\expandafter\string\@nextchar}%
   \@chnum
   \if \@nextchar c\z@ \else
    \if \@nextchar l\@ne \else
     \if \@nextchar r\tw@ \else
   \z@ \@chclass
   \if\@nextchar |\@ne \else
    \if \@nextchar !6 \else
     \if \@nextchar @7 \else
      \if \@nextchar (8 \else
       \if \@nextchar )9 \else
  10
  \@chnum
  \if \@nextchar m\thr@@\else
   \if \@nextchar p4 \else
    \if \@nextchar b5 \else
   \z@ \@chclass \z@ \@preamerr \z@ \fi \fi \fi \fi
   \fi \fi  \fi  \fi  \fi  \fi  \fi \fi \fi \fi \fi \fi}
\gdef\arraybackslash{\let\\=\@arraycr}
\def\@textsubscript#1{{\m@th\ensuremath{_{\mbox{\fontsize\sf@size\z@#1}}}}}
\def\Panel#1#2#3#4{\multicolumn{#3}{){\columncolor{#2}}#4}{#1}}
\def\abbr{}
\def\corr{}
\def\expan{}
\def\gap{}
\def\orig{}
\def\reg{}
\def\ref{}
\def\sic{}
\def\persName{}\def\name{}
\def\placeName{}
\def\orgName{}
\def\textcal#1{{\fontspec{Lucida Calligraphy}#1}}
\def\textgothic#1{{\fontspec{Lucida Blackletter}#1}}
\def\textlarge#1{{\large #1}}
\def\textoverbar#1{\ensuremath{\overline{#1}}}
\def\textquoted#1{‘#1’}
\def\textsmall#1{{\small #1}}
\def\textsubscript#1{\@textsubscript{\selectfont#1}}
\def\textxi{\ensuremath{\xi}}
\def\titlem{\itshape}
\newenvironment{biblfree}{}{\ifvmode\par\fi }
\newenvironment{bibl}{}{}
\newenvironment{byline}{\vskip6pt\itshape\fontsize{16pt}{18pt}\selectfont}{\par }
\newenvironment{citbibl}{}{\ifvmode\par\fi }
\newenvironment{docAuthor}{\ifvmode\vskip4pt\fontsize{16pt}{18pt}\selectfont\fi\itshape}{\ifvmode\par\fi }
\newenvironment{docDate}{}{\ifvmode\par\fi }
\newenvironment{docImprint}{\vskip 6pt}{\ifvmode\par\fi }
\newenvironment{docTitle}{\vskip6pt\bfseries\fontsize{22pt}{25pt}\selectfont}{\par }
\newenvironment{msHead}{\vskip 6pt}{\par}
\newenvironment{msItem}{\vskip 6pt}{\par}
\newenvironment{rubric}{}{}
\newenvironment{titlePart}{}{\par }

\newcolumntype{L}[1]{){\raggedright\arraybackslash}p{#1}}
\newcolumntype{C}[1]{){\centering\arraybackslash}p{#1}}
\newcolumntype{R}[1]{){\raggedleft\arraybackslash}p{#1}}
\newcolumntype{P}[1]{){\arraybackslash}p{#1}}
\newcolumntype{B}[1]{){\arraybackslash}b{#1}}
\newcolumntype{M}[1]{){\arraybackslash}m{#1}}
\definecolor{label}{gray}{0.75}
\def\unusedattribute#1{\sout{\textcolor{label}{#1}}}
\DeclareRobustCommand*{\xref}{\hyper@normalise\xref@}
\def\xref@#1#2{\hyper@linkurl{#2}{#1}}
\begingroup
\catcode`\_=\active
\gdef_#1{\ensuremath{\sb{\mathrm{#1}}}}
\endgroup
\mathcode`\_=\string"8000
\catcode`\_=12\relax

\usepackage[a4paper,twoside,lmargin=1in,rmargin=1in,tmargin=1in,bmargin=1in,marginparwidth=0.75in]{geometry}
\usepackage{framed}

\definecolor{shadecolor}{gray}{0.95}
\usepackage{longtable}
\usepackage[normalem]{ulem}
\usepackage{fancyvrb}
\usepackage{fancyhdr}
\usepackage{graphicx}
\usepackage{marginnote}

\renewcommand{\@cite}[1]{#1}


\renewcommand*{\marginfont}{\itshape\footnotesize}

\def\Gin@extensions{.pdf,.png,.jpg,.mps,.tif}

  \pagestyle{fancy}

\usepackage[pdftitle={Information Security Risk Assessment for Banking Sector-A Case study of Pakistani Banks},
 pdfauthor={}]{hyperref}
\hyperbaseurl{}

	 \paperwidth210mm
	 \paperheight297mm
              
\def\@pnumwidth{1.55em}
\def\@tocrmarg {2.55em}
\def\@dotsep{4.5}
\setcounter{tocdepth}{3}
\clubpenalty=8000
\emergencystretch 3em
\hbadness=4000
\hyphenpenalty=400
\pretolerance=750
\tolerance=2000
\vbadness=4000
\widowpenalty=10000

\renewcommand\section{\@startsection {section}{1}{\z@}%
     {-1.75ex \@plus -0.5ex \@minus -.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\Large\bfseries}}
\renewcommand\subsection{\@startsection{subsection}{2}{\z@}%
     {-1.75ex\@plus -0.5ex \@minus- .2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\Large}}
\renewcommand\subsubsection{\@startsection{subsubsection}{3}{\z@}%
     {-1.5ex\@plus -0.35ex \@minus -.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\large}}
\renewcommand\paragraph{\@startsection{paragraph}{4}{\z@}%
     {-1ex \@plus-0.35ex \@minus -0.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\normalsize}}
\renewcommand\subparagraph{\@startsection{subparagraph}{5}{\parindent}%
     {1.5ex \@plus1ex \@minus .2ex}%
     {-1em}%
     {\reset@font\normalsize\bfseries}}


\def\l@section#1#2{\addpenalty{\@secpenalty} \addvspace{1.0em plus 1pt}
 \@tempdima 1.5em \begingroup
 \parindent \z@ \rightskip \@pnumwidth 
 \parfillskip -\@pnumwidth 
 \bfseries \leavevmode #1\hfil \hbox to\@pnumwidth{\hss #2}\par
 \endgroup}
\def\l@subsection{\@dottedtocline{2}{1.5em}{2.3em}}
\def\l@subsubsection{\@dottedtocline{3}{3.8em}{3.2em}}
\def\l@paragraph{\@dottedtocline{4}{7.0em}{4.1em}}
\def\l@subparagraph{\@dottedtocline{5}{10em}{5em}}
\@ifundefined{c@section}{\newcounter{section}}{}
\@ifundefined{c@chapter}{\newcounter{chapter}}{}
\newif\if@mainmatter 
\@mainmattertrue
\def\chaptername{Chapter}
\def\frontmatter{%
  \pagenumbering{roman}
  \def\thechapter{\@roman\c@chapter}
  \def\theHchapter{\roman{chapter}}
  \def\thesection{\@roman\c@section}
  \def\theHsection{\roman{section}}
  \def\@chapapp{}%
}
\def\mainmatter{%
  \cleardoublepage
  \def\thechapter{\@arabic\c@chapter}
  \setcounter{chapter}{0}
  \setcounter{section}{0}
  \pagenumbering{arabic}
  \setcounter{secnumdepth}{6}
  \def\@chapapp{\chaptername}%
  \def\theHchapter{\arabic{chapter}}
  \def\thesection{\@arabic\c@section}
  \def\theHsection{\arabic{section}}
}
\def\backmatter{%
  \cleardoublepage
  \setcounter{chapter}{0}
  \setcounter{section}{0}
  \setcounter{secnumdepth}{2}
  \def\@chapapp{\appendixname}%
  \def\thechapter{\@Alph\c@chapter}
  \def\theHchapter{\Alph{chapter}}
  \appendix
}
\newenvironment{bibitemlist}[1]{%
   \list{\@biblabel{\@arabic\c@enumiv}}%
       {\settowidth\labelwidth{\@biblabel{#1}}%
        \leftmargin\labelwidth
        \advance\leftmargin\labelsep
        \@openbib@code
        \usecounter{enumiv}%
        \let\p@enumiv\@empty
        \renewcommand\theenumiv{\@arabic\c@enumiv}%
	}%
  \sloppy
  \clubpenalty4000
  \@clubpenalty \clubpenalty
  \widowpenalty4000%
  \sfcode`\.\@m}%
  {\def\@noitemerr
    {\@latex@warning{Empty `bibitemlist' environment}}%
    \endlist}

\def\tableofcontents{\section*{\contentsname}\@starttoc{toc}}
\parskip0pt
\parindent1em
\def\Panel#1#2#3#4{\multicolumn{#3}{){\columncolor{#2}}#4}{#1}}
\newenvironment{reflist}{%
  \begin{raggedright}\begin{list}{}
  {%
   \setlength{\topsep}{0pt}%
   \setlength{\rightmargin}{0.25in}%
   \setlength{\itemsep}{0pt}%
   \setlength{\itemindent}{0pt}%
   \setlength{\parskip}{0pt}%
   \setlength{\parsep}{2pt}%
   \def\makelabel##1{\itshape ##1}}%
  }
  {\end{list}\end{raggedright}}
\newenvironment{sansreflist}{%
  \begin{raggedright}\begin{list}{}
  {%
   \setlength{\topsep}{0pt}%
   \setlength{\rightmargin}{0.25in}%
   \setlength{\itemindent}{0pt}%
   \setlength{\parskip}{0pt}%
   \setlength{\itemsep}{0pt}%
   \setlength{\parsep}{2pt}%
   \def\makelabel##1{\upshape ##1}}%
  }
  {\end{list}\end{raggedright}}
\newenvironment{specHead}[2]%
 {\vspace{20pt}\hrule\vspace{10pt}%
  \phantomsection\label{#1}\markright{#2}%

  \pdfbookmark[2]{#2}{#1}%
  \hspace{-0.75in}{\bfseries\fontsize{16pt}{18pt}\selectfont#2}%
  }{}
      \def\TheFullDate{2010-03-15 (revised: 15 March 2010)}
\def\TheID{\makeatother }
\def\TheDate{2010-03-15}
\title{Information Security Risk Assessment for Banking Sector-A Case study of Pakistani Banks}
\author{}\makeatletter 
\makeatletter
\newcommand*{\cleartoleftpage}{%
  \clearpage
    \if@twoside
    \ifodd\c@page
      \hbox{}\newpage
      \if@twocolumn
        \hbox{}\newpage
      \fi
    \fi
  \fi
}
\makeatother
\makeatletter
\thispagestyle{empty}
\markright{\@title}\markboth{\@title}{\@author}
\renewcommand\small{\@setfontsize\small{9pt}{11pt}\abovedisplayskip 8.5\p@ plus3\p@ minus4\p@
\belowdisplayskip \abovedisplayskip
\abovedisplayshortskip \z@ plus2\p@
\belowdisplayshortskip 4\p@ plus2\p@ minus2\p@
\def\@listi{\leftmargin\leftmargini
               \topsep 2\p@ plus1\p@ minus1\p@
               \parsep 2\p@ plus\p@ minus\p@
               \itemsep 1pt}
}
\makeatother
\fvset{frame=single,numberblanklines=false,xleftmargin=5mm,xrightmargin=5mm}
\fancyhf{} 
\setlength{\headheight}{14pt}
\fancyhead[LE]{\bfseries\leftmark} 
\fancyhead[RO]{\bfseries\rightmark} 
\fancyfoot[RO]{}
\fancyfoot[CO]{\thepage}
\fancyfoot[LO]{\TheID}
\fancyfoot[LE]{}
\fancyfoot[CE]{\thepage}
\fancyfoot[RE]{\TheID}
\hypersetup{citebordercolor=0.75 0.75 0.75,linkbordercolor=0.75 0.75 0.75,urlbordercolor=0.75 0.75 0.75,bookmarksnumbered=true}
\fancypagestyle{plain}{\fancyhead{}\renewcommand{\headrulewidth}{0pt}}

\date{}
\usepackage{authblk}

\providecommand{\keywords}[1]
{
\footnotesize
  \textbf{\textit{Index terms---}} #1
}

\usepackage{graphicx,xcolor}
\definecolor{GJBlue}{HTML}{273B81}
\definecolor{GJLightBlue}{HTML}{0A9DD9}
\definecolor{GJMediumGrey}{HTML}{6D6E70}
\definecolor{GJLightGrey}{HTML}{929497} 

\renewenvironment{abstract}{%
   \setlength{\parindent}{0pt}\raggedright
   \textcolor{GJMediumGrey}{\rule{\textwidth}{2pt}}
   \vskip16pt
   \textcolor{GJBlue}{\large\bfseries\abstractname\space}
}{%   
   \vskip8pt
   \textcolor{GJMediumGrey}{\rule{\textwidth}{2pt}}
   \vskip16pt
}

\usepackage[absolute,overlay]{textpos}

\makeatother 
      \usepackage{lineno}
      \linenumbers
      
\begin{document}

             \author[1]{Dr. Usman  Munir}

             \author[2]{Irfan  Manarvi}

             \affil[1]{  CASE}

\renewcommand\Authands{ and }

\date{\small \em Received: 8 February 2010 Accepted: 5 March 2010 Published: 15 March 2010}

\maketitle


\begin{abstract}
        


The ever increasing trend of Information Technology (IT) in organizations has given them new horizon in international market. Organizations now totally depend on IT for better and effective communication and daily operational tasks. Advancements in IT have exposed organization to information security threats also. Several methods and standards for assessment of information security in an organization are available today. Problems with these methods and standards are that they neither provide quantitative analysis of information security nor access potential loses information malfunctioning could create. This paper highlight the necessity of information security tool which could provide quantitative risk assessment along with the classification of risk management controls like management, operational and technical controls in an organizations. It is not possible for organizations to establish information security effectively without knowing the loopholes in their controls. Empirical data for this research was collected from the 5 major banks of Pakistan through two different questionnaires. It is observed that mostly banks have implemented the technical and operational control properly, but the real crux, the information security culture in organization is still a missing link in information security management.

\end{abstract}


\keywords{Quantitative information security assessment, information security controls, information security, information security management system, risk, ris}

\begin{textblock*}{18cm}(1cm,1cm) % {block width} (coords) 
\textcolor{GJBlue}{\LARGE Global Journals \LaTeX\ JournalKaleidoscope\texttrademark}
\end{textblock*}

\begin{textblock*}{18cm}(1.4cm,1.5cm) % {block width} (coords) 
\textcolor{GJBlue}{\footnotesize \\ Artificial Intelligence formulated this projection for compatibility purposes from the original article published at Global Journals. However, this technology is currently in beta. \emph{Therefore, kindly ignore odd layouts, missed formulae, text, tables, or figures.}}
\end{textblock*}


\let\tabcellsep& 	 	 		 
\section[{INTRODUCTION}]{INTRODUCTION}\par
nformation is considered as an asset like other important business assets and Information Security (IS) is a way of protecting information from a wide range of threats in order to ensure business continuity, minimize risk, and maximize return on investments and business opportunities  {\ref [1 and 2]}. Over the years the usage of Information Technology (IT) has increased massively in organizations and in society and to cater the ever increasing requirement of information flow, information systems has become complex and multifaceted \hyperref[b3]{[4]}. IT has made electronic communication and internet necessary in all organizations. This necessity has brought efficiency and threats of hacking and intrusion with it \hyperref[b4]{[5]}. With all these advancements in the field of IT, dependency of organizational business fusnctionality on it has increased the requirement of securing organizational information from threats \hyperref[b2]{[3]}[4] \hyperref[b5]{[6]} \hyperref[b7]{[8]}. Information security is somewhat a hard task to achieve. One of the prime reasons is that not much data related to information security management and threats to organizations' About 1 -Department of Engineering Management Department, CASE, Islamabad, Pakistan About 2 -Department of Mechanical Engineering, HITEC University, Taxila, Pakistan information is available due to confidentiality \hyperref[b11]{[12]}. Second, costs associated to information security restrict organizations from implementing information security management systems in organizations \hyperref[b12]{[13]}. Third, information security is not just a technical issue, it is more a managerial issue, therefore it is also required to train employees about the information security without which attaining information security is impossible \hyperref[b5]{[6]}. It is proposed implementing information security management policy in such a way that it calculates the assets values first and then predicts the losses associated to it \hyperref[b9]{[10]}.But so far available quantitative risk assessment methods and tools are either expensive or little information about their usability and performance are available \hyperref[b8]{[9]}. Although operational risk management techniques are functional in many originations but it is not possible to handle information risks with the perspective of operational risk management. It is therefore advised combining information security management with operational risk management for a better economical solution \hyperref[b6]{[7]}. More dependency of world on information technology systems and processes made management of information technology risk a practical necessity \hyperref[b13]{[14]}. Organizations adopt information security product, services, processes and tools which range from complex mathematical algorithms to the expert risk management resources. Organizations are not sure about the optimal security quality and required a cost effective information security methods which can provide them optimal security with minimum cost.Knowledge sharing and collaboration of intra-organizational cross functional teams for risk management is required for proper risk management strategies \hyperref[b14]{[15]}. Management vision towards information security risk and involving internal stakeholder in this task is the need of the time. A more pragmatic reason is that the development of information security methods within organisations is rather an ad hoc process than a systematic one. This process generates new knowledge about information security risk management by constituting valuable organizational intelligence. Therefore, it is very important to have a systematic process, which ensures that the acquired knowledge will be elicited, shared, and managed appropriately \hyperref[b11]{[12]}.Codification and personalization are two strategies for information security. Codification is the people to document strategy to ensure intranets and databases are loaded with best practices, case studies and guidance for people in their day-to-day work. Personalization is the people-to-people strategy to link people and grow network and information security culture \hyperref[b15]{[16]}. These two strategies established the reusability of implemented processes in organization and information I sharing background in organization. A creditable and effective method for accessing current state of information security in organizations is desirable. Good information about the current system required for good decision. Assessment of current method would help in future improvement in the system traded by its implementation cost \hyperref[b16]{[17]}. Information security of an enterprise was defined in term of tree structure \hyperref[b17]{[18]}. Prioritized the structure on enterprise information security basis \hyperref[b18]{[19]}, to clarify the assessment scope and minimize the assessment cost. Finally, the credibility of the assessment results is addressed with a statistical approach combined with ideas from historical research and witness interrogation psychology \hyperref[b19]{[20]}. II. 
\section[{INFORMATION SECURITY RISK MANAGEMENT TOOL:}]{INFORMATION SECURITY RISK MANAGEMENT TOOL:}\par
COBRA TM   A number of standards are available on information security management system like ISO 17799, ISO 27001, the Control Objectives for Information and related technology (Cobit), and National Institute of Standards and Technology (NIST). These standards describe the requirement of information security in the organizations. But so far experts for information security implementation are requires. Whose services are expensive and rely only on their judgment for information security risk management process. Available tools are also expensive and generic. COBRA TM risk consultant is software which provides the following risk assessment:\par
? Compliance with the ISO information security standards BS7799 and 17799. 
\section[{? Support implementing Information Security}]{? Support implementing Information Security}\par
Management System in organization and also assess risk associated with organization information. ? Quantitative risk assessment of information security threats. ? Supported with a built-in knowledge base which acts as a database for evaluating information security risks. ? Perform risk assessment and also suggest its mitigation approaches. ? Assess Business Continuity Plan of an organization against its profile. ? Provide comprehensive reports about the information security risk.\par
Four knowledge base available to perform risk assessment are as follows and shown in Fig  For the risk assessment a questionnaire have to be filled by a respondent which then generate a comprehensive report of its organizational risk.\par
III. 
\section[{RESEARCH METHODOLOGY}]{RESEARCH METHODOLOGY}\par
This study was conducted to analyze quantitative risks associated with information of major banks operating in Pakistan and to study security control, which are implemented for protecting their critical information. Two separate questionnaires were designed for the analysis of information security and its controls. First questionnaire was developed by using built-in knowledge base from High Level Risk Assessment section of COBRA TM software.\par
After reviewing the COBRA TM software analysis another questionnaire was designed to evaluate the management control in these banks.High Level Risk Assessment questionnaire was filled by the information security auditors and by higher management of these banks to get the response about their implemented security policies and its impact on their information security management. Second questionnaire was filled by the five persons of various management level of each bank to check the management vision toward the information security and awareness of information security in these banks. To perform information security analysis, threats to information confidentiality, integrity, and availability were checked against the information security controls like management, technical, and operational controls.\par
IV. 
\section[{QUANTITATIVE ANALYSIS OF COBRA TM}]{QUANTITATIVE ANALYSIS OF COBRA TM} 
\section[{QUESTIONNAIRE}]{QUESTIONNAIRE}\par
COBRATM asked questions to evaluate potential threats and security policies in an organization. To determine the high level risk related to the information of the organization, questions were classified into the four categories: a. Availability b. Business Impact Analysis c. Confidentiality d. Integrity\par
Few important questions of COBRATM software along with their assigned points are discussed bellow to observe its functionality. 
\section[{1) Availability Questionnaire}]{1) Availability Questionnaire}\par
In availability section the questions will the highest value are discussed in table 1 below: The questionnaire pertaining to Availability discussed the business continuity plan, business redemption, and disaster recovery plan. In this section maximum points were given to business continuity plan because it ensures the continuity of critical business functions by providing methods and procedures for dealing with long outages and disasters. It is a broader approach in which continuity of a business during any disaster is ensured until that disaster is either curtailed or business operation returns to its normal circumstances. Physical access controls were also evaluated because appropriate physical controls are necessary to eliminate potential losses and risks associated to information assets, weak physical access controls could not prevent intruder from causing any harm to information processing facility or information assets. Therefore, COBRA TM ask particular questions related to appropriate physical access control not only to evaluate these control for better analysis of security situation but also to create awareness in management for importance of these controls.\par
2) Business Impact Questionnaire\par
Business Impact considered as a functional analysis in which a team collects data through interviews and documentary resources. In business impact analysis section the COBRA TM gave maximum points to questions which have direct and indirect impact on the stakeholders and customers. The confidence of customer and internal and external stakeholders on business products and business management process is essential for the success. All these questions are concerned on unavailability of critical information to business in term of customers and stakeholders confidence on the organization. COBRA TM also bifurcate impact of losing critical information with respect to time to establish minimum time when the organization would have maximum disadvantage of losing that information. The confidence of organization or management on its internal and external employees and stakeholders is considered as a key to establish proper information security checks.  
\section[{Ideas Only}]{Ideas Only}\par
Nothing COBRA TM gives emphasis on questions related to the physical and logical access controls because in the current scenarios when companies have threat over internet about the security breach and intrusion, lapses on these parts can harm the organization in term of market repute and profitability. Besides these other important questions are related to security structure and culture of an enterprise.\par
Information security is based mostly on culture of an organization. If in an organizations every employee is aware about the information security requirement, policies, and have good understanding of their responsibilities towards information security, organization will have less threats of losing information than. 
\section[{4) Integrity Questionnaire}]{4) Integrity Questionnaire}\par
Integrity of information means protecting data and information resource from being altered in an unauthorized fashion. The questions in the integrity section are assigned the following scores as in table \hyperref[tab_4]{4}: In this section the COBRA TM asks management about their confidence on internal and external security checks which are implemented to save data from any unofficial changes. Organizations mostly have external and internal threats to their information. The internal threat can lead to more catastrophic impact than the external one. Therefore it is important for the organization to have a full confidence on the internal security controls and procedures on retrieving and adding data. If internal procedure and process of input and output of information has some loopholes then it is important to adjust and redefine these procedure and make it as firm as required for the integrity of information. As a result organizations assign different privileges to users so that only designated officials can alter or process information. These controls help organization in maintaining the security checks and also give sense of responsibility to the personals authorized for any changes. 
\section[{5)}]{5)} 
\section[{Bifurcation of Information Threats in COBRA TM}]{Bifurcation of Information Threats in COBRA TM}\par
Besides the importance of some particular questions on others COBRA TM has given equal score to availability, integrity and confidentiality of information as shown in Fig 2  {\ref that} all parts have given equal percentage of 33\%.  According to it, threat to information confidentiality is 51.23\% showed that the information could be intruded. Whereas threat to integrity of information is 52.37\% means information could be altered or in some cases a completeness of information was questionable for organization. Threat to availability of information in this bank was at 52.17\% too. This software suggested implementing security checks on data warehouses and physical data places. The figure \hyperref[fig_4]{5} shows the percentage of security controls in bank (A). It may be seen that the management control is lower being 26\% against suggested 49.89\%. The operational control is being at 59\% where the suggested percentage at 31.76\%. Technical control being lower than the suggested 18.44\% was at 15\%. This showed that the bank overall operational threats were catered properly whereas the implementation of information security policy was uncertain and lack of information security awareness in the management functions. The threats to confidentiality of information were at 50.08\% showed an unauthorized access of data. The threats to integrity is maintained well which were at 1.32\% only. Threats to availability of information were reported 51.05 \% showed concern to information record keeping. Precise review of report showed that information integrity related to the information accuracy was well maintained in the bank. But other information security threats like confidentiality and availability were quite high. These high levels of threats showed that the availability of critical information to unauthorized and unwanted individuals or to the third-part. This can harm the reputation of the bank and ultimately can affect its business. It may be seen that the management control was lower being 13\% showed a high threats related to it. The technical control and operational controls were optimal being at 18\% and at 69\%. This showed an improper management control in this bank. It led to a risk of improper information security policy and its implementation, information leakage by employees, unsecure risk culture in organization, and unawareness of information security. The threats to availability of information were highest at 54.67\% followed by integrity at 52.20\% and confidentiality at 51.17\%. These high threats showed that availability of critical information were to unauthorized and unwanted individuals or to the third-part. This could harm bank reputation and ultimately to its business. These high threats also showed vulnerability to correctness, completeness, and protection of information from intrusion. It may be seen that technical and management controls were lower being at 11\% and 30\%. Operational control maintained properly as its being at 59\%. Risks associated to management controls like policy establishment and information security culture could be higher in this bank. The threats to availability of information were highest at 52.15\% followed by integrity at 50.28\%. Threats to confidentiality of information were reported at 11.48\%. The high threats of availability and integrity showed that critical information were accessible for unauthorized changes. On other hand information were not available at required time or were not managed properly.  It may be seen that technical control is being at 17\% than suggested 18\%. Management control being at 23\% is lower than suggested one. The operational control was being managed properly as it was at 69\% against the suggested 31.76\% by the software. The management control at 23\% showed that a risk on policy establishment, weak information security culture, and poor management vision towards information security. The Bank (E) provides microfinance services and act as a catalyst in stabilizing the country's newly formed microfinance sector. The risk assessment done by COBRA TM is shown in Fig 12  {\ref .} The threats to availability of information were highest at 52.12\% followed by integrity at 51.33\% and confidentiality at 50.26\%. The high threats showed that critical information were accessible for unauthorized change. Availability of information was at required time or was not managed properly. Threat of unauthorized changes and completeness of information were also present.  The security controls implemented in all banks is being evaluated in Fig 14  {\ref .} It is being seen that operational control in all banks was at 57\% followed by management control at 23\% and technical control at 20\%.  The COBRA TM suggested a percentage of 49.89\% to management control, 31.76\% to operational control, and 18.44\% technical control for optimal information security.\par
The comparative analysis of proposed and actual percentage of control showed that operational control in all banks was well maintained. The technical control was also maintained properly. The management control in all banks individually and in this consolidated report was at lowest percentage being at 23\% shown that its not up-to the COBRA TM recommended mark that is almost 50\%. Therefore the risk associated to management control must have to be high in all banks according to COBRA TM reports. Risk associated with the management control. ? Ineffective decision making ? Poor establishment of information security risk management policies/ procedures ? Unawareness of Information Security related risks ? Information secure culture ? Information Security not a part of overall business process. ? Fraudulent system usage ? Reputational damage ? Lack of business continuity planning ? Information security not a part of strategic planning 
\section[{Consolidated Analysis of Management Contols}]{Consolidated Analysis of Management Contols}\par
The second phase of survery is accomplished by developing sepecific questionnaire to evaluate the COBRA TM results. The questionnaire was divided into two sections. First section was about the management vision towards information security. Second section was about the information security awareness and information security culture in banks. A specific value was assigned to all the questions to have a quantitave analysis of banks management control.\par
To check the matuarity level of management control in these banks, overall score of the questinnaire was lied between -20 to 20. The maturity of management control was further classified into four levels shown in Fig \hyperref[fig_14]{15}.  The management controls in all banks is being at the solid level with a range from 5.4 to 7.5. The maximum management control is being in bank (D) at 7.5 and lowest in bank (B) at 5.4. The bank (A) is being at 5.9 followed by bank(C) and bank (E) at 6.7 and 6.  COBRA TM gave a comprehensive information security risk analysis report but few short coming of this tool are: ? Risk raiting is not established properly in the COBRA TM e.g Fire cause more demage to information/ infrastructre etc than malfunctioning of any hardware. COBRA TM has given the same score to such cases.\par
? For risk assessment it is recommended to do the asset evalution of all the tangible and intangible assets of the organization. COBRA TM doest not evaluate individual asset value of organization in high level risk assessment. Due to this in case of any loss the accurate financial loss can not be predicted through this software.\par
? In risk assessment process, the range of accepted risks in COBRA TM is very low, from 0-19 score. any score above than 19 will be treated as a high expectancy of threat to organization. One drawback of this hard coded low risk acceptancy is that the risk level of all organization mostly falls in between 50\% and above which in real scenario is exceptionally high risk for any organization. Secondly, perdiction for which organization like to use quantitaive tools than qualitative assessment tool is not obtainable.\par
? COBRA TM risk assessment reports coveres lot of information security risk area and also inform the requirement of security improvement at the exact areas, but do not inform the exact measures to mitigate them.\par
? Awareness of information security requirement to all employees of organization is essence of information security management system. Since as per NIST \hyperref[b8]{[9]}, employees are the biggest threat to organization information than any other attack. COBRA TM ignores that High Level Risk Assessment domain.\par
? Re-assessment of COBRA TM results by conducting second survey showed substantial differences, for instance, in COBRA TM reports the level of the management control implementation in all banks was between 13\% to 30\% whereas in re-assessment survey this range was between 50\% to 75\%.\par
? Besides all these drawbacks COBRA TM still facilitate the management in identification of information security risks. 
\section[{VII. FUTURE WORK}]{VII. FUTURE WORK}\par
Information security risk management framework which would cover the information security governance and show the results related to the information security controls so that organizations can focus and improve the deficient area regarding information security management.\par
VIII.\begin{figure}[htbp]
\noindent\textbf{1}\includegraphics[]{image-2.png}
\caption{\label{fig_0}Fig 1 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{2}\includegraphics[]{image-3.png}
\caption{\label{fig_1}Fig 2 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{3}\includegraphics[]{image-4.png}
\caption{\label{fig_2}Fig 3 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{4}\includegraphics[]{image-5.png}
\caption{\label{fig_3}Fig 4 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{5}\includegraphics[]{image-6.png}
\caption{\label{fig_4}Fig 5 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{6}\includegraphics[]{image-7.png}
\caption{\label{fig_5}Fig 6 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{7}\includegraphics[]{image-8.png}
\caption{\label{fig_6}Fig 7 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{8}\includegraphics[]{image-9.png}
\caption{\label{fig_7}Fig 8 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{9}\includegraphics[]{image-10.png}
\caption{\label{fig_8}Fig 9 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{10}\includegraphics[]{image-11.png}
\caption{\label{fig_9}Fig 10 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{11}\includegraphics[]{image-12.png}
\caption{\label{fig_10}Fig 11 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{12}\includegraphics[]{image-13.png}
\caption{\label{fig_11}Fig 12 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{13}\includegraphics[]{image-14.png}
\caption{\label{fig_12}Fig 13 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{14}\includegraphics[]{image-15.png}
\caption{\label{fig_13}Fig 14 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{15}\includegraphics[]{image-16.png}
\caption{\label{fig_14}Fig 15 :}\end{figure}
  \begin{figure}[htbp]
\noindent\textbf{1} \par 
\begin{longtable}{P{0.009774609015639374\textwidth}P{0.365179392824287\textwidth}P{0.1501379944802208\textwidth}P{0.027759889604415826\textwidth}P{0.00234590616375345\textwidth}P{0.15522079116835327\textwidth}P{0.12198712051517939\textwidth}P{0.0007819687212511499\textwidth}P{0.016812327506899722\textwidth}}
\tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \multicolumn{2}{l}{Media/Other}\\
\tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep Power Failure\tabcellsep \tabcellsep 20\\
\tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep Software Error\tabcellsep \tabcellsep 20\\
\tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \multicolumn{2}{l}{Infection}\\
\tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \multicolumn{2}{l}{By Computer}\tabcellsep 20\\
\tabcellsep \multicolumn{2}{l}{: Availability questionnaire}\tabcellsep \tabcellsep \tabcellsep \tabcellsep Virus\tabcellsep \\
\multicolumn{2}{l}{No Availability}\tabcellsep Answer\tabcellsep Scr\tabcellsep \tabcellsep \tabcellsep Intro\tabcellsep Of\\
\tabcellsep Is there a formal and workable\tabcellsep Yes\tabcellsep 0\tabcellsep \tabcellsep \tabcellsep \multicolumn{2}{l}{Malicious}\tabcellsep 20\\
1 2 3 4 5\tabcellsep Business Redemptions Plan in place? How confident are you that the plan is adequate to ensure a controlled recovery and continuance of business within the time frames specified as significant/critical: When the Business Continuity Plan was last tested? Are the contingency arrangements for all key components reasonable and appropriate? How confident are you that the contingency arrangements and Business Continuity Plan would enable continuance and eventual recovery from the loss of a key building (due perhaps to serious fire, flooding, explosion, etc) without serious or critical impact on the business? How confident are you that the contingency arrangements and\tabcellsep No 100 Confident \% Fairly Confident Comfortable Concerned Not Confident Within the 12 months 1-2 years 2-3 years 4-5 years more than 5 years ago Yes No 100 \% confident Fairly Confident Comfortable Not Really Confident Concerned 100 confident \%\tabcellsep 50 0 0. 5 1 20 50 0 0. 5 1 20 50 0 50 0 0. 5 1 20 50 0\tabcellsep 8 9 10\tabcellsep Ignoring the recovery element of the Business Continuity Plan, to which of the following (if any), is the exposure level significant? Are specific back-up and recovery measures in place to handle both loss of critical data and serious software error in a timely and appropriate fashion? Are physical access controls/practices for areas that may hold sensitive/confidential information appropriate?\tabcellsep \multicolumn{2}{l}{Coding Hacking/Elect ronic Sabotage Loss Of 3rd Party Service Loss of Comm/ Network Service Operator Error /Sabotage Industrial Action by Key Staff Other Threat Yes No Certainly Adequate Generally OK A cause for concern A major problem}\tabcellsep 20 20 20 20 20 20 0 20 0 0. 5 20 50\\
\tabcellsep Business Continuity Plan would\tabcellsep Fairly\tabcellsep 0.\tabcellsep \tabcellsep \tabcellsep \tabcellsep \\
\tabcellsep enable continuance and eventual\tabcellsep Confident\tabcellsep 5\tabcellsep \tabcellsep \tabcellsep \tabcellsep \\
6\tabcellsep recovery from the loss of key\tabcellsep \multicolumn{2}{l}{Comfortable 1}\tabcellsep \tabcellsep \tabcellsep \tabcellsep \\
\tabcellsep personnel (due perhaps to serious accident, industrial\tabcellsep Not Really Confident\tabcellsep 20\tabcellsep \tabcellsep \tabcellsep \tabcellsep \\
\tabcellsep action, etc) without serious or critical impact on the business?\tabcellsep Concerned\tabcellsep 50\tabcellsep \tabcellsep \tabcellsep \tabcellsep \\
\tabcellsep \tabcellsep Fire/Flooding/ Explosion\tabcellsep 20\tabcellsep \tabcellsep \tabcellsep \tabcellsep \\
\tabcellsep \tabcellsep Hardware/\tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \\
\tabcellsep \tabcellsep Equipment\tabcellsep 20\tabcellsep \tabcellsep \tabcellsep \tabcellsep \\
\tabcellsep \tabcellsep Malfunctin\tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \\
\tabcellsep \tabcellsep Hardware/ Equipment/\tabcellsep 20\tabcellsep \tabcellsep \tabcellsep \tabcellsep \end{longtable} \par
  {\small\itshape [Note: 7Ignoring the recovery element of the Business Continuity Plan, to which of the following (if any), is the exposure level significant?]} 
\caption{\label{tab_1}Table 1}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{2} \par 
\begin{longtable}{P{0.06968785257615645\textwidth}P{0.10772846934937946\textwidth}P{0.1253102670176758\textwidth}P{0.004475366679202708\textwidth}P{0.006073711921775103\textwidth}P{0.413012410680707\textwidth}P{0.002237683339601354\textwidth}P{0.010229409552463332\textwidth}P{0.11124482888303873\textwidth}}
\tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \multicolumn{3}{l}{In the worst case scenario means no backup, how quickly could}\tabcellsep 2 hours\\
\tabcellsep \tabcellsep \tabcellsep \tabcellsep 15\tabcellsep \multicolumn{3}{l}{unavailability SIGNIFICANT impact in terms result in}\tabcellsep 24 hours 7days\\
\tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \multicolumn{3}{l}{of current/future revenues and}\tabcellsep 1 month\\
\tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \multicolumn{3}{l}{other direct financial losses?}\tabcellsep Never\\
\tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \multicolumn{3}{l}{In the worst case scenario, how}\tabcellsep 2 hours\\
\tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \multicolumn{3}{l}{quickly could unavailability}\\
\multicolumn{4}{l}{Than developing hierarchy of business functions and applies a classification scheme to indicate each individual function critical level. Question from the Business Impact Analysis are shown bellow in}\tabcellsep 16\tabcellsep \multicolumn{3}{l}{have a SIGNIFICANT impact in terms of customer, shareholder, public or departmental confidence?}\tabcellsep 24 hours 7days 1 month Never\\
\multicolumn{2}{l}{table 2.}\tabcellsep \tabcellsep \tabcellsep \tabcellsep How\tabcellsep quickly\tabcellsep could\tabcellsep 2 hours\\
No\tabcellsep Business Impact\tabcellsep Answer Less Than\tabcellsep Scr\tabcellsep 17\tabcellsep \multicolumn{3}{l}{unavailability SIGNIFICANT impact in terms have a of contractual, regulatory, or legal obligations?}\tabcellsep 24 hours 7days 1 month Never\\
11 12\tabcellsep What was the total revenue for this business function/service during the last financial year? What is the highest likely financial value throughout per\tabcellsep \multicolumn{2}{l}{10,000,000 0 10,000,000 to 100,000,000 1 100,000,000 to 500,000,000 5 More than 500,000,000 20 Less than 500,000 0 500,000 to 5,000,000 1 5,000,000}\tabcellsep 18 19\tabcellsep \multicolumn{3}{l}{If confidential/key information was disclosed to one or more competitors, what is the worst impact that could result: If confidential/key information was disclosed, what could be the worst impact in terms of current/future revenues and other direct financial losses?}\tabcellsep None Moderate Significant Substantial Critical None Moderate Significant Substantial Critical\\
\tabcellsep day :\tabcellsep \multicolumn{2}{l}{to 50,000,000 5}\tabcellsep \tabcellsep \multicolumn{3}{l}{If confidential/key information}\tabcellsep None\\
\tabcellsep \tabcellsep \multicolumn{2}{l}{More than 50,000,000 20}\tabcellsep 20\tabcellsep \multicolumn{3}{l}{was disclosed, what could the worst impact be in terms of}\tabcellsep Moderate\\
\tabcellsep \tabcellsep Financial\tabcellsep \tabcellsep \tabcellsep \multicolumn{3}{l}{customer, shareholder, public or}\tabcellsep Significant\\
\tabcellsep \tabcellsep \multicolumn{2}{l}{Accounting 5}\tabcellsep \tabcellsep \multicolumn{2}{l}{departmental confidence?}\tabcellsep Substantial\\
\tabcellsep \tabcellsep Trading/\tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep Critical\\
13\tabcellsep Which of the following types of function are directly performed :\tabcellsep Dealing Payroll Management info/ Support Research\tabcellsep 5 5 6 5\tabcellsep 21\tabcellsep \multicolumn{3}{l}{If confidential/key information was disclosed, would there be any implications in terms of contractual, regulatory, or legal obligations?}\tabcellsep None Moderate Significant Substantial Critical\\
\tabcellsep \tabcellsep \multicolumn{2}{l}{Manufacturing 5 Infra-structure Support 5 Retail 5 Other 5}\tabcellsep 22\tabcellsep \multicolumn{3}{l}{If the data/information lost its integrity (through error, deliberate unauthorized alteration, fraud, etc), what could be the worst impact in terms of direct financial loss?}\tabcellsep None Moderate Significant Substantial Critical\\
14\tabcellsep How many other systems or business units internal to this enterprise have a dependency upon this one?\tabcellsep Minor Dependency Significant Dependency Total\tabcellsep 1 2\tabcellsep 23\tabcellsep \multicolumn{3}{l}{If the data/information lost its integrity, what could the worst impact be in terms of customer, shareholder, public or}\tabcellsep None Moderate Significant Substantial\\
\tabcellsep \tabcellsep Dependency\tabcellsep 3\tabcellsep \tabcellsep \multicolumn{2}{l}{departmental confidence?}\tabcellsep Critical\end{longtable} \par
 
\caption{\label{tab_2}Table 2 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{4} \par 
\begin{longtable}{P{0.009400921658986174\textwidth}P{0.5656221198156682\textwidth}P{0.006267281105990783\textwidth}P{0.24520737327188938\textwidth}P{0.017235023041474656\textwidth}P{0.006267281105990783\textwidth}}
No\tabcellsep Integrity\tabcellsep \tabcellsep Answer\tabcellsep Scr\\
\tabcellsep \tabcellsep \tabcellsep 100\tabcellsep \%\\
34\tabcellsep \multicolumn{2}{l}{How confident are you that there is no significant risk of serious ERROR being introduced during the input of important data/information?}\tabcellsep \multicolumn{2}{l}{confident Fairly Confident Comfortable 1 0 0. 5 Not Really Confident 20}\\
\tabcellsep \tabcellsep \tabcellsep \multicolumn{2}{l}{Concerned 50}\\
\tabcellsep \multicolumn{2}{l}{Consider the situation with respect to INTENTIONAL unauthorized manipulation of input data/information, by both}\tabcellsep 100 confident Fairly Confident\tabcellsep \%\tabcellsep 0 0. 5\\
35\tabcellsep \multicolumn{2}{l}{internal and external parties. How confident are you that there is no significant risk of serious breach during the input of important data/information?}\tabcellsep \multicolumn{2}{l}{Comfortable Not Really Confident Concerned 50 1 20}\\
\tabcellsep \tabcellsep \tabcellsep 100\tabcellsep \%\\
\tabcellsep \tabcellsep \tabcellsep confident\tabcellsep 0\\
\tabcellsep \multicolumn{2}{l}{How confident are you that there}\tabcellsep Fairly\\
36\tabcellsep \multicolumn{2}{l}{is no significant risk of serious error being introduced via}\tabcellsep \multicolumn{2}{l}{Confident Comfortable 1 0.5}\\
\tabcellsep \multicolumn{2}{l}{program error or malfunction?}\tabcellsep \multicolumn{2}{l}{Not Really}\\
\tabcellsep \tabcellsep \tabcellsep Confident\tabcellsep 20\\
\tabcellsep \tabcellsep \tabcellsep \multicolumn{2}{l}{Concerned 50}\\
\tabcellsep \tabcellsep \tabcellsep Certainly\tabcellsep 0\\
\tabcellsep \multicolumn{2}{l}{Are the controls in place to}\tabcellsep Okay\tabcellsep 0.5\\
37\tabcellsep \multicolumn{2}{l}{prevent modification of program source the unauthorized}\tabcellsep \multicolumn{2}{l}{Cause of Concern}\tabcellsep 20\\
\tabcellsep code appropriate?\tabcellsep \tabcellsep Major\\
\tabcellsep \tabcellsep \tabcellsep Problem\tabcellsep 50\\
\tabcellsep \multicolumn{2}{l}{Are logical access controls}\tabcellsep No\\
38\tabcellsep \multicolumn{2}{l}{sufficient to protect sensitive data/information from}\tabcellsep weakness Minor\tabcellsep 0\\
\tabcellsep unauthorized\tabcellsep EXTERNAL\tabcellsep Weakness\tabcellsep 0.5\end{longtable} \par
 
\caption{\label{tab_4}Table 4 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{} \par 
\begin{longtable}{P{0.85\textwidth}}
2. Management control\\
of all banks lied at the solid level. It was not in superior\\
level in any of the banks.At solid level organization\\
achieved the following management control:\\
? Information security policy is being rolled out\\
? Supporting standards and procedures are being\\
developed\\
?\end{longtable} \par
 
\caption{\label{tab_8}}\end{figure}
 		 		\backmatter  			  				\begin{bibitemlist}{1}
\bibitem[Chen and Li -Secconfig ()]{b5}\label{b5} 	 		\textit{},  		 			Ching-Jiang Chen 		,  		 			Ming-Hwa Li -Secconfig 		.  		 978-0-7695-3322-3.  		2008. IEEE.  	 	 (A Pre-Active Information Security Protection Technique?) 
\bibitem[(E) -I nformation Technology-Security techniques-Information Security Management Systems-Requirements?]{b1}\label{b1} 	 		\textit{(E) -I nformation Technology-Security techniques-Information Security Management Systems-Requirements?},  		 ISO/ IEC FDIS 27001:2005.  		p. .  	 
\bibitem[Papadaki and Polemi ()]{b11}\label{b11} 	 		‘-Towards a systematic approach for improving information security risk management methods?’.  		 			K Papadaki 		,  		 			D Polemi 		.  	 	 		\textit{Proc. 18th Annual IEEE International Symposium on Personal, Indoor and Mobile Radio Communication (PIMRC)},  				 (18th Annual IEEE International Symposium on Personal, Indoor and Mobile Radio Communication (PIMRC))  		2007.  	 
\bibitem[Johansson ()]{b18}\label{b18} 	 		‘Asse ssment of Enterprise Information Security -The Importance of Prioritization?’.  		 			E Johansson 		.  	 	 		\textit{the Proceedings of the 9th IEEE International Annual Enterprise Distributed Object Computing Conference (EDOC)},  				 (Enschede, The Netherlands)  		September 19-23, 2005.  	 
\bibitem[Johansson ()]{b17}\label{b17} 	 		‘Assess ment of EIS -An ATD Definition?’.  		 			E Johansson 		.  	 	 		\textit{the Proceedings of the 3rd Annual Conference on Systems Engineering Research (CSER)},  				March 23-25, 2005.  	 
\bibitem[Port et al.]{b3}\label{b3} 	 		\textit{Department of Information Technology Management, University of Hawaii -Strategic Planning for Information Security and Assurance?},  		 			Daniel Port 		,  		 			Rick Kazman 		,  		 			Ann Takenaka 		.  		 978-0-7695-3126-7/ 2008 IEEE.  		 	 
\bibitem[Desouza et al. ()]{b15}\label{b15} 	 		 			K C Desouza 		,  		 			Y Awazu 		,  		 			P. -M Baloh 		,  		 			Anaging 		.  	 	 		\textit{Global Software Development Efforts: Issues and Practices?},  				2006. 23 p. .  	 
\bibitem[Ekstedt ()]{b16}\label{b16} 	 		 			M Ekstedt 		.  		\textit{C onsistent Enterprise Software System Architecture for the CIO -A utility-Cost Approach?, Proceedings of the 37th annual Hawaii International Conference on System Sciences (HICSS)},  				2004.  	 
\bibitem[Heinz Lothar ()]{b6}\label{b6} 	 		\textit{Gereon Strauch and Christian Buddendick? Applications for IT-Risk Management -Requirements and Practical Evaluation?},  		 			Grob Heinz Lothar 		.  		 DOI 0-7695-3102-4.  		2008. IEEE.  	 
\bibitem[Long et al. ()]{b10}\label{b10} 	 		\textit{Inf ormation Security Risk Assessment Based On Analytic Hierarchy Process and Fuzzy Comprehensive? 978-0-7695-3402-2},  		 			Xiao Long 		,  		 			Qi Yong 		,  		 			Li Qianmu 		.  		2008. IEEE.  	 
\bibitem[Institute for Advance Management System Research(IAMSR) -A DSS for Information Security Analysis: Computer Support in a Company's Risk Management?0-7803-3280-6 ()]{b12}\label{b12} 	 		\textit{Institute for Advance Management System Research(IAMSR) -A DSS for Information Security Analysis: Computer Support in a Company's Risk Management?0-7803-3280-6},  		1996. IEEE.  		 			Thomas Finne, Abo Akademi University 		 	 
\bibitem[ISO/ IEC FDIS 17799 -Information Technologysecurity techniques-Code of practice for information security management? ()]{b0}\label{b0} 	 		\textit{ISO/ IEC FDIS 17799 -Information Technologysecurity techniques-Code of practice for information security management?},  		2005.  	 
\bibitem[Symantec ()]{b13}\label{b13} 	 		\textit{IT Risk Management Report 2: Myths and Realities?},  		 			Symantec 		.  		 \url{http://eval.symantec.com}  		2008.  	 
\bibitem[Brown and Duguid ()]{b14}\label{b14} 	 		‘Know ledge and organization: A social-practice perspective?’.  		 			J Brown 		,  		 			P Duguid 		.  	 	 		\textit{Organization Science}  		2001. 12 p. .  	 
\bibitem[Fong-Hao ()]{b4}\label{b4} 	 		\textit{Liu -C onstructing Enterprise Information Network Security Risk Management Mechanism By Using Ontology? 0-7695-2847-3},  		 			Fong-Hao 		.  		2007. IEEE.  	 
\bibitem[R isk Management: Implementation principles and Inventories for Risk Management/Risk Assessment method and tools? ()]{b8}\label{b8} 	 		 \url{http://www.enisa.europa.eu}  		\textit{R isk Management: Implementation principles and Inventories for Risk Management/Risk Assessment method and tools?},  				2006. p. .  		 			ENISA (European Network and Information Security Agency 		 	 
\bibitem[Julie et al. ()]{b9}\label{b9} 	 		\textit{Ryan -Per formance Metrics for Information Security Risk Management? 1540-7993},  		 			J C Julie 		,  		 			Ryan 		,  		 			J Danel 		.  		2008. IEEE.  	 
\bibitem[Edvardsson ()]{b19}\label{b19} 	 		‘The Need for Critical Thinking in Evaluation of Information?’.  		 			B Edvardsson 		.  	 	 		\textit{Proceedings of the 18th International Conference on Critical Thinking},  				 (the 18th International Conference on Critical ThinkingRohnert Park, USA)  		1998.  	 
\bibitem[Thomas Nowey and Hannes Federath -Collection of Quantitative Data on Security Incidents? 0-7695-2775-2 ()]{b2}\label{b2} 	 		\textit{Thomas Nowey and Hannes Federath -Collection of Quantitative Data on Security Incidents? 0-7695-2775-2},  		2007. IEEE.  	 
\bibitem[Wade et al. ()]{b7}\label{b7} 	 		 			H Wade 		,  		 			Linda Baker 		,  		 			Wallace 		.  		\textit{Is Information Security Under Control? Investigating Quality in Information Security Management?},  				2007. IEEE. p. .  	 
\end{bibitemlist}
 			 		 	 
\end{document}
