A combination of the two approaches will likely provide improved protection. For electronic commerce to flourish as a viable alternative to traditional commercial transactions, each party to an online transaction must determine what, if any, liability is associated with a given transaction. The development of legal standards is based on the principle of due care. That care which an ordinarily prudent person would have exercised under the same or similar circumstances. Risk analysis is the process of identifying security risks, determining their magnitude, and identifying areas needing safeguards.
Risk analysis is a part of risk management.
Traditional risk analysis methodologies have existed for many years. They can include hardware, software, data, people, documentation, and supplies. Vulnerabilities are any person, threat, act, or idea that may cause a loss in information secrecy, integrity, availability, or any other defined information security goal. The expected annual loss factors in loss of business opportunity, cost of data recovery and reconstruction, loss in sales, and loss in public relations among others. In scenarios where information and responsibilities are distributed among different entities, a role-based methodology is more intuitive and lends itself toward a more accurate depiction of the process.