CRAC : Confidentiality risk analysis and IT-architecture comparison of business networks

The leakage of confidential information (e.g. industrial secrets, patient records and user credentials) is one of the risks that have to be accounted for and mitigated by organizations dealing with confidential data. Unfortunately, assessing confidentiality risk is challenging, particularly in the presence of crossorganization cooperation, like in the case of outsourcing. This is due to the complexity of business networks. This paper presents an IT-architecture based method for assessing and comparing confidentiality risks of IT-based business networks from the perspective of one of the organizations in the network.