Examples Of Risk Assessment Methodologies

Specific Risk Assessment Methodologies

When security managers need to utilized a methodology to identify their organization acceptable risk levels they can use one of the following:

• OCTAVE (Operational Critical Threat, Assets, and Vulnerability Evaluation). Developed by Carnegie Mellon University’s Software Engineer Institute (SEI), OCTAVE is an approach where analysis identifies assets and their criticality, identify vulnerabilities and threats, evaluate risk, and create a protection strategy to reduce risk.

• FRAP (Facilitated Risk Analysis Process). This is a qualitative risk analysis methodology that can be used to pres-screen a subject of analysis as a means to determine whether a full blown quantitative risk analysis is needed.

• Spanning Tree Analysis. This can be thought of as a visual method for identifying categories of risk, as well as specific risks, using the metaphor for a tree ad its branches. This approach would be similar to a Mind Map for identifying categories and specific threats and/or vulnerabilities.

NSIT 800-30, Risk Management Guide for Information Technology Systems. This document describes a forma approach to risk assessment that includes threat and vulnerability identification, control analysis, impact analysis, and a matrix depiction of risk determination and control recommendations. When security professionals apply a qualitative or quantitative risk assessment, an organization management can begin the process of deciding what steps, if any, need to be implemented to manage the risk identified in the risk assessment. There are four general approaches to risk assessments (Gregory, 2010):

• Risk avoidance: Generally the most extreme form of risk treatment, in risk avoidance the associated ac...

... middle of paper ...

... analyst, software engineers, programmers, and end users in the project design and development. Sense, there is no industry-wide SDLC, and organization can utilize any one, or a combination of SDLC methods that fits its organization model. The SDLC primary function is to provide a framework for the phases of a software development project from defining the functional requirements to the implementation phase. Regardless of the method chosen by the organization, the SDLC outlines the key essential phases, which can be depicted together or as separate entities. The model chosen by the organization should be based on the project. For example, some models are better designed for long-term projects, complex projects, while others more suited for short-term projects. The key to success in this process is that a formalized SDLC is utilized by the developers (Tipton, 2010)