Heräte validoitu riskien arvioinnin prosessimalli organisaation menestyksen tukemiseksi

Riskien arviointi on osa organisaation kilpailukykyä, jolloin ketterät sekä dynaamiset toimintatavat ovat ratkaisevassa asemassa. Epävarmuus ja toimintaympäristön nopeat muutokset tuovat mukanaan myös mahdollisuuksia. Laadukas riskien arviointi on keino erottua kilpailijoista, varmistaa osaltaan org...

Täydet tiedot

Bibliografiset tiedot
Päätekijät: Kokkomäki, Tuomas, Nortunen, Mika
Muut tekijät: Faculty of Information Technology, Informaatioteknologian tiedekunta, Tietojenkäsittelytieteiden laitos, Department of Computer Science and Information Systems, University of Jyväskylä, Jyväskylän yliopisto
Aineistotyyppi: Pro gradu
Kieli:fin
Julkaistu: 2016
Aiheet:
Linkit: https://jyx.jyu.fi/handle/123456789/51201
_version_ 1826225780176191488
author Kokkomäki, Tuomas Nortunen, Mika
author2 Faculty of Information Technology Informaatioteknologian tiedekunta Tietojenkäsittelytieteiden laitos Department of Computer Science and Information Systems University of Jyväskylä Jyväskylän yliopisto
author_facet Kokkomäki, Tuomas Nortunen, Mika Faculty of Information Technology Informaatioteknologian tiedekunta Tietojenkäsittelytieteiden laitos Department of Computer Science and Information Systems University of Jyväskylä Jyväskylän yliopisto Kokkomäki, Tuomas Nortunen, Mika Faculty of Information Technology Informaatioteknologian tiedekunta Tietojenkäsittelytieteiden laitos Department of Computer Science and Information Systems University of Jyväskylä Jyväskylän yliopisto
author_sort Kokkomäki, Tuomas
datasource_str_mv jyx
description Riskien arviointi on osa organisaation kilpailukykyä, jolloin ketterät sekä dynaamiset toimintatavat ovat ratkaisevassa asemassa. Epävarmuus ja toimintaympäristön nopeat muutokset tuovat mukanaan myös mahdollisuuksia. Laadukas riskien arviointi on keino erottua kilpailijoista, varmistaa osaltaan organisaation luotettavuus ja trendien tunnistamisen kautta löytää uusia mahdollisuuksia tulevaisuuden innovaatioille. Yhä monimutkaistuva maailma luo organisaatiolle tarpeen tehdä tehokkaita toimenpiteitä entistä nopeammin. Organisaatioiden tulee pystyä reagoimaan nopeasti muuttuvan toimintaympäristön asettamiin haasteisiin. Tutkimuksen tavoitteena oli muodostaa tieteellisen tutkimuksen, riskien arviointiin soveltuvien menetelmien, kuten standardien ja tutkimuksen aikana suoritettujen tietoturvajohtajien haastatteluiden perusteella ketterä ja dynaaminen riskien arvioinnin prosessimalli. Muodostetun prosessimallin on tarkoitus auttaa organisaatioita yhtenäistämään riskien arvioinnin prosessia organisaation eri tasoilla ja tuottamaan yhdenmukaista ja vertailukelpoista materiaalia riskien hallitsemiseksi ja tulevan riskien arvioinnin taustamateriaaliksi. Tutkimus toteutettiin kaksivaiheisena laadullisena tutkimuksena, jonka empiirinen materiaali kerättiin yhteensä kuudesta suomalaisesta finanssialan organisaatioista. Muodostettu riskien arvioinnin malli validoitiin esittelemällä se kolmelle turvallisuuden ammattilaisille. Malli tarjoaa mahdollisuuden mahdollisimman monipuoliseen tiedon keräämiseen. Mallin taustalla on ajatus uhkien sekä muiden herätteiden kattavasta tunnistamisesta, riskien arvioinnin nopeuttamisesta, yksinkertaistamisesta ja yhdenmukaistamisesta organisaation strategian mukaisesti. Tieto ja tilannekuva ovat aina jossain määrin puutteellisia. On tärkeää, että riskien arvioinnin prosessi on joustava ja dynaaminen. Malli pyrkii esittämään riskien arvioinnin prosessina, jossa olemassa olevaa tietoa käytetään mahdollisimman tehokkaasti hyväksi ja sitä pyritään aktiivisesti täydentämään prosessin edetessä. Mallin tavoite on pyrkiä mahdollisimman kattavaan tietoon ja tilannekuvaan. Tutkimuksen näkökulma on informaatioteknologian ja tietoturvajohtajan näkökulma, mutta mallin muodostamisessa on pyritty käytettävyyteen myös muilla toimialoilla. Risk assessment is part of the competitiveness of the organization. This makes agile and dynamic approaches crucial. The uncertainty and rapid changes in the operating environment also bring opportunities to the organizations. High- quality risk assessment is a way of differentiation from competitors, to ensure the reliability of the organization and through the identification of trends to find new opportunities for future innovations. Increasingly complex world is creating a need for the organizations to take effective measures faster and faster. Organizations must be able to respond quickly to the challenges posed by rapidly changing business environment. The aim of this study was to establish an agile and dynamic process model for risk assessment based on scientific research, risk management standards and interviews of information security officers. Formed process model is intended to help organizations to harmonize risk assessment process at different levels of organization and to provide consistent and comparable material to control the risks and for the background material for future risk assessment of the organization. The study was conducted as a two phase qualitative study, in which the empirical material was collected from a total of six Finnish financial sector organizations. The generated model of risk assessment was validated by presenting it to three security professionals. The generated model offers the opportunity to collect as versatile data as possible. In the background of this model is the idea of identification of threats as well as other possible triggers. The process of this model is aiming to comprehensive identification of these triggers and speeding up, simplification and harmonization of risk assessment in accordance with the organization's strategy. Information and situational awareness are always to some extent incomplete and, therefore, it is important that the risk assessment process is a flexible and dynamic. Model aims to present a risk assessment as a process in which existing data is used as efficiently as possible and it will actively seek complementarity as process progresses. This model’s objective is to ensure the widest possible knowledge and situational awareness. The approach if this study is an information technology and information security officer point of view, but the formulated risk assessment model is intended to have usability also outside of this context.
first_indexed 2023-03-22T10:00:32Z
format Pro gradu
free_online_boolean 1
fullrecord [{"key": "dc.contributor.advisor", "value": "Salo, Markus", "language": "", "element": "contributor", "qualifier": "advisor", "schema": "dc"}, {"key": "dc.contributor.advisor", "value": "Moilanen, Panu", "language": "", "element": "contributor", "qualifier": "advisor", "schema": "dc"}, {"key": "dc.contributor.author", "value": "Kokkom\u00e4ki, Tuomas", "language": null, "element": "contributor", "qualifier": "author", "schema": "dc"}, {"key": "dc.contributor.author", "value": "Nortunen, Mika", "language": null, "element": "contributor", "qualifier": "author", "schema": "dc"}, {"key": "dc.date.accessioned", "value": "2016-09-05T11:17:05Z", "language": "", "element": "date", "qualifier": "accessioned", "schema": "dc"}, {"key": "dc.date.available", "value": "2016-09-05T11:17:05Z", "language": "", "element": "date", "qualifier": "available", "schema": "dc"}, {"key": "dc.date.issued", "value": "2016", "language": null, "element": "date", "qualifier": "issued", "schema": "dc"}, {"key": "dc.identifier.other", "value": "oai:jykdok.linneanet.fi:1575489", "language": null, "element": "identifier", "qualifier": "other", "schema": "dc"}, {"key": "dc.identifier.uri", "value": "https://jyx.jyu.fi/handle/123456789/51201", "language": "", "element": "identifier", "qualifier": "uri", "schema": "dc"}, {"key": "dc.description.abstract", "value": "Riskien arviointi on osa organisaation kilpailukyky\u00e4, jolloin ketter\u00e4t sek\u00e4 dynaamiset toimintatavat ovat ratkaisevassa asemassa. Ep\u00e4varmuus ja toimintaymp\u00e4rist\u00f6n nopeat muutokset tuovat mukanaan my\u00f6s mahdollisuuksia. Laadukas riskien arviointi on keino erottua kilpailijoista, varmistaa osaltaan organisaation luotettavuus ja trendien tunnistamisen kautta l\u00f6yt\u00e4\u00e4 uusia mahdollisuuksia tulevaisuuden innovaatioille. Yh\u00e4 monimutkaistuva maailma luo organisaatiolle tarpeen tehd\u00e4 tehokkaita toimenpiteit\u00e4 entist\u00e4 nopeammin. Organisaatioiden tulee pysty\u00e4 reagoimaan nopeasti muuttuvan toimintaymp\u00e4rist\u00f6n asettamiin haasteisiin. Tutkimuksen tavoitteena oli muodostaa tieteellisen tutkimuksen, riskien arviointiin soveltuvien menetelmien, kuten standardien ja tutkimuksen aikana suoritettujen tietoturvajohtajien haastatteluiden perusteella ketter\u00e4 ja dynaaminen riskien arvioinnin prosessimalli. Muodostetun prosessimallin on tarkoitus auttaa organisaatioita yhten\u00e4ist\u00e4m\u00e4\u00e4n riskien arvioinnin prosessia organisaation eri tasoilla ja tuottamaan yhdenmukaista ja vertailukelpoista materiaalia riskien hallitsemiseksi ja tulevan riskien arvioinnin taustamateriaaliksi. Tutkimus toteutettiin kaksivaiheisena laadullisena tutkimuksena, jonka empiirinen materiaali ker\u00e4ttiin yhteens\u00e4 kuudesta suomalaisesta finanssialan organisaatioista. Muodostettu riskien arvioinnin malli validoitiin esittelem\u00e4ll\u00e4 se kolmelle turvallisuuden ammattilaisille. Malli tarjoaa mahdollisuuden mahdollisimman monipuoliseen tiedon ker\u00e4\u00e4miseen. Mallin taustalla on ajatus uhkien sek\u00e4 muiden her\u00e4tteiden kattavasta tunnistamisesta, riskien arvioinnin nopeuttamisesta, yksinkertaistamisesta ja yhdenmukaistamisesta organisaation strategian mukaisesti. Tieto ja tilannekuva ovat aina jossain m\u00e4\u00e4rin puutteellisia. On t\u00e4rke\u00e4\u00e4, ett\u00e4 riskien arvioinnin prosessi on joustava ja dynaaminen. Malli pyrkii esitt\u00e4m\u00e4\u00e4n riskien arvioinnin prosessina, jossa olemassa olevaa tietoa k\u00e4ytet\u00e4\u00e4n mahdollisimman tehokkaasti hyv\u00e4ksi ja sit\u00e4 pyrit\u00e4\u00e4n aktiivisesti t\u00e4ydent\u00e4m\u00e4\u00e4n prosessin edetess\u00e4. Mallin tavoite on pyrki\u00e4 mahdollisimman kattavaan tietoon ja tilannekuvaan. Tutkimuksen n\u00e4k\u00f6kulma on informaatioteknologian ja tietoturvajohtajan n\u00e4k\u00f6kulma, mutta mallin muodostamisessa on pyritty k\u00e4ytett\u00e4vyyteen my\u00f6s muilla toimialoilla.", "language": "fi", "element": "description", "qualifier": "abstract", "schema": "dc"}, {"key": "dc.description.abstract", "value": "Risk assessment is part of the competitiveness of the organization. This makes agile and dynamic approaches crucial. The uncertainty and rapid changes in the operating environment also bring opportunities to the organizations. High- quality risk assessment is a way of differentiation from competitors, to ensure the reliability of the organization and through the identification of trends to find new opportunities for future innovations. Increasingly complex world is creating a need for the organizations to take effective measures faster and faster. Organizations must be able to respond quickly to the challenges posed by rapidly changing business environment. The aim of this study was to establish an agile and dynamic process model for risk assessment based on scientific research, risk management standards and interviews of information security officers. Formed process model is intended to help organizations to harmonize risk assessment process at different levels of organization and to provide consistent and comparable material to control the risks and for the background material for future risk assessment of the organization. The study was conducted as a two phase qualitative study, in which the empirical material was collected from a total of six Finnish financial sector organizations. The generated model of risk assessment was validated by presenting it to three security professionals. The generated model offers the opportunity to collect as versatile data as possible. In the background of this model is the idea of identification of threats as well as other possible triggers. The process of this model is aiming to comprehensive identification of these triggers and speeding up, simplification and harmonization of risk assessment in accordance with the organization's strategy. Information and situational awareness are always to some extent incomplete and, therefore, it is important that the risk assessment process is a flexible and dynamic. Model aims to present a risk assessment as a process in which existing data is used as efficiently as possible and it will actively seek complementarity as process progresses. This model\u2019s objective is to ensure the widest possible knowledge and situational awareness. The approach if this study is an information technology and information security officer point of view, but the formulated risk assessment model is intended to have usability also outside of this context.", "language": "en", "element": "description", "qualifier": "abstract", "schema": "dc"}, {"key": "dc.description.provenance", "value": "Submitted using Plone Publishing form by Tuomas Kokkom\u00e4ki (tuoantko) on 2016-09-05 11:17:03.818639. Form: Pro gradu -lomake (https://kirjasto.jyu.fi/julkaisut/julkaisulomakkeet/pro-gradu-lomake). JyX data: [jyx_publishing-allowed (fi) =True]", "language": "en", "element": "description", "qualifier": "provenance", "schema": "dc"}, {"key": "dc.description.provenance", "value": "Submitted by jyx lomake-julkaisija (jyx-julkaisija.group@korppi.jyu.fi) on 2016-09-05T11:17:04Z\r\nNo. of bitstreams: 2\r\nURN:NBN:fi:jyu-201609053961.pdf: 8079215 bytes, checksum: 87d8fa3da3053a7f37f13dcb82013cff (MD5)\r\nlicense.html: 5166 bytes, checksum: 957bccecaf95af74e6964e0fc06888a2 (MD5)", "language": "en", "element": "description", "qualifier": "provenance", "schema": "dc"}, {"key": "dc.description.provenance", "value": "Made available in DSpace on 2016-09-05T11:17:05Z (GMT). No. of bitstreams: 2\r\nURN:NBN:fi:jyu-201609053961.pdf: 8079215 bytes, checksum: 87d8fa3da3053a7f37f13dcb82013cff (MD5)\r\nlicense.html: 5166 bytes, checksum: 957bccecaf95af74e6964e0fc06888a2 (MD5)\r\n Previous issue date: 2016", "language": "en", "element": "description", "qualifier": "provenance", "schema": "dc"}, {"key": "dc.format.extent", "value": "1 verkkoaineisto (155 sivua)", "language": null, "element": "format", "qualifier": "extent", "schema": "dc"}, {"key": "dc.format.mimetype", "value": "application/pdf", "language": null, "element": "format", "qualifier": "mimetype", "schema": "dc"}, {"key": "dc.language.iso", "value": "fin", "language": null, "element": "language", "qualifier": "iso", "schema": "dc"}, {"key": "dc.rights", "value": "In Copyright", "language": "en", "element": "rights", "qualifier": null, "schema": "dc"}, {"key": "dc.subject.other", "value": "riskienhallinta", "language": "", "element": "subject", "qualifier": "other", "schema": "dc"}, {"key": "dc.subject.other", "value": "riskien arviointi", "language": "", "element": "subject", "qualifier": "other", "schema": "dc"}, {"key": "dc.subject.other", "value": "standardit", "language": "", "element": "subject", "qualifier": "other", "schema": "dc"}, {"key": "dc.subject.other", "value": "kyberturvallisuus", "language": "", "element": "subject", "qualifier": "other", "schema": "dc"}, {"key": "dc.subject.other", "value": "tilannekuva", "language": "", "element": "subject", "qualifier": "other", "schema": "dc"}, {"key": "dc.subject.other", "value": "prosessi", "language": "", "element": "subject", "qualifier": "other", "schema": "dc"}, {"key": "dc.title", "value": "Her\u00e4te : validoitu riskien arvioinnin prosessimalli organisaation menestyksen tukemiseksi", "language": null, "element": "title", "qualifier": null, "schema": "dc"}, {"key": "dc.title.alternative", "value": "Validoitu riskien arvioinnin prosessimalli organisaation menestyksen tukemiseksi", "language": null, "element": "title", "qualifier": "alternative", "schema": "dc"}, {"key": "dc.type", "value": "master thesis", "language": null, "element": "type", "qualifier": null, "schema": "dc"}, {"key": "dc.identifier.urn", "value": "URN:NBN:fi:jyu-201609053961", "language": null, "element": "identifier", "qualifier": "urn", "schema": "dc"}, {"key": "dc.type.ontasot", "value": "Master\u2019s thesis", "language": "en", "element": "type", "qualifier": "ontasot", "schema": "dc"}, {"key": "dc.type.ontasot", "value": "Pro gradu -tutkielma", "language": "fi", "element": "type", "qualifier": "ontasot", "schema": "dc"}, {"key": "dc.contributor.faculty", "value": "Faculty of Information Technology", "language": "en", "element": "contributor", "qualifier": "faculty", "schema": "dc"}, {"key": "dc.contributor.faculty", "value": "Informaatioteknologian tiedekunta", "language": "fi", "element": "contributor", "qualifier": "faculty", "schema": "dc"}, {"key": "dc.contributor.department", "value": "Tietojenk\u00e4sittelytieteiden laitos", "language": "fi", "element": "contributor", "qualifier": "department", "schema": "dc"}, {"key": "dc.contributor.department", "value": "Department of Computer Science and Information Systems", "language": "en", "element": "contributor", "qualifier": "department", "schema": "dc"}, {"key": "dc.contributor.organization", "value": "University of Jyv\u00e4skyl\u00e4", "language": "en", "element": "contributor", "qualifier": "organization", "schema": "dc"}, {"key": "dc.contributor.organization", "value": "Jyv\u00e4skyl\u00e4n yliopisto", "language": "fi", "element": "contributor", "qualifier": "organization", "schema": "dc"}, {"key": "dc.subject.discipline", "value": "Cyber Security", "language": "en", "element": "subject", "qualifier": "discipline", "schema": "dc"}, {"key": "dc.subject.discipline", "value": "Kyberturvallisuus", "language": "fi", "element": "subject", "qualifier": "discipline", "schema": "dc"}, {"key": "dc.date.updated", "value": "2016-09-05T11:17:05Z", "language": "", "element": "date", "qualifier": "updated", "schema": "dc"}, {"key": "yvv.contractresearch.funding", "value": "0", "language": "", "element": "contractresearch", "qualifier": "funding", "schema": "yvv"}, {"key": "dc.type.coar", "value": "http://purl.org/coar/resource_type/c_bdcc", "language": null, "element": "type", "qualifier": "coar", "schema": "dc"}, {"key": "dc.rights.accesslevel", "value": "openAccess", "language": "fi", "element": "rights", "qualifier": "accesslevel", "schema": "dc"}, {"key": "dc.type.publication", "value": "masterThesis", "language": null, "element": "type", "qualifier": "publication", "schema": "dc"}, {"key": "dc.subject.oppiainekoodi", "value": "601", "language": null, "element": "subject", "qualifier": "oppiainekoodi", "schema": "dc"}, {"key": "dc.subject.yso", "value": "riskienhallinta", "language": null, "element": "subject", "qualifier": "yso", "schema": "dc"}, {"key": "dc.subject.yso", "value": "riskinarviointi", "language": null, "element": "subject", "qualifier": "yso", "schema": "dc"}, {"key": "dc.subject.yso", "value": "standardit", "language": null, "element": "subject", "qualifier": "yso", "schema": "dc"}, {"key": "dc.subject.yso", "value": "kyberturvallisuus", "language": null, "element": "subject", "qualifier": "yso", "schema": "dc"}, {"key": "dc.subject.yso", "value": "tilannekuva", "language": null, "element": "subject", "qualifier": "yso", "schema": "dc"}, {"key": "dc.subject.yso", "value": "prosessit", "language": null, "element": "subject", "qualifier": "yso", "schema": "dc"}, {"key": "dc.format.content", "value": "fulltext", "language": null, "element": "format", "qualifier": "content", "schema": "dc"}, {"key": "dc.rights.url", "value": "https://rightsstatements.org/page/InC/1.0/", "language": null, "element": "rights", "qualifier": "url", "schema": "dc"}, {"key": "dc.type.okm", "value": "G2", "language": null, "element": "type", "qualifier": "okm", "schema": "dc"}]
id jyx.123456789_51201
language fin
last_indexed 2025-02-18T10:56:04Z
main_date 2016-01-01T00:00:00Z
main_date_str 2016
online_boolean 1
online_urls_str_mv {"url":"https:\/\/jyx.jyu.fi\/bitstreams\/e311166b-1a45-420b-9e31-f8b9e166f5a8\/download","text":"URN:NBN:fi:jyu-201609053961.pdf","source":"jyx","mediaType":"application\/pdf"}
publishDate 2016
record_format qdc
source_str_mv jyx
spellingShingle Kokkomäki, Tuomas Nortunen, Mika Heräte : validoitu riskien arvioinnin prosessimalli organisaation menestyksen tukemiseksi riskienhallinta riskien arviointi standardit kyberturvallisuus tilannekuva prosessi Cyber Security Kyberturvallisuus 601 riskinarviointi prosessit
title Heräte : validoitu riskien arvioinnin prosessimalli organisaation menestyksen tukemiseksi
title_alt Validoitu riskien arvioinnin prosessimalli organisaation menestyksen tukemiseksi
title_full Heräte : validoitu riskien arvioinnin prosessimalli organisaation menestyksen tukemiseksi
title_fullStr Heräte : validoitu riskien arvioinnin prosessimalli organisaation menestyksen tukemiseksi Heräte : validoitu riskien arvioinnin prosessimalli organisaation menestyksen tukemiseksi
title_full_unstemmed Heräte : validoitu riskien arvioinnin prosessimalli organisaation menestyksen tukemiseksi Heräte : validoitu riskien arvioinnin prosessimalli organisaation menestyksen tukemiseksi
title_short Heräte
title_sort heräte validoitu riskien arvioinnin prosessimalli organisaation menestyksen tukemiseksi
title_sub validoitu riskien arvioinnin prosessimalli organisaation menestyksen tukemiseksi
title_txtP Heräte : validoitu riskien arvioinnin prosessimalli organisaation menestyksen tukemiseksi
topic riskienhallinta riskien arviointi standardit kyberturvallisuus tilannekuva prosessi Cyber Security Kyberturvallisuus 601 riskinarviointi prosessit
topic_facet 601 Cyber Security Kyberturvallisuus kyberturvallisuus prosessi prosessit riskien arviointi riskienhallinta riskinarviointi standardit tilannekuva
url https://jyx.jyu.fi/handle/123456789/51201 http://www.urn.fi/URN:NBN:fi:jyu-201609053961
work_keys_str_mv AT kokkomäkituomas herätevalidoituriskienarvioinninprosessimalliorganisaationmenestyksentukemiseksi