RROI Analysis in Assessing Risk of Open Source Software in Organization: A Case Study in Malaysia

Abstract

This paper describes the process of assessing risk for open source software in an organization. The process starts with identification of internal and external risk in an organization. Then, the potential of proactively securing organization’s system will be analyzed before the threat arises. Risk-based return on investment analysis is used to measures the effectiveness on how the organization uses the resources to proactively reducing the risk. It involve the steps of quantifying the cost of resources in one particular place to accommodate the mitigation plan. Further, the result will be compared to the cost of resources in all places in case of reactive effort. Finding shows that effort to proactively secure company from threats by using antivirus should be conducted with estimation of calculated risk-based return on investment is more than 1820%.