preview

Strategic Assessment Of Risk Assessment Methodologies

Decent Essays

Mostly all security methodologies call for some kind of objective assessment of risks. This is simply so because, security controls selections are centered on the known risks there are to an organization 's assets and operations. There is also an alternative, which would consist of randomly selecting security controls without using any type of methodical threat or control analysis. If the alternative method is used to implement the security controls, there will be issues such as: having security controls implemented in the wrong places, and the organization will be left vulnerable to unanticipated threats and resources will be wasted.
Risk assessment methodologies establishes rules for what is to be assessed and establishes who will need to be involved. Risk assessment methodologies also establishes the terminology that will be used when discussing the risk, establishes the degree of risk when quantifying, qualifying, and comparing risk, and they also help to establish what documentation must be collected as a result of the assessments. The two most popular risk assessment methodologies that are used today are: OCTAVE (Operationally Critical Threat, Asset, and Vulnerability Evaluation) which was developed at Carnegie Mellon University, and the NIST risk assessment methodology that is documented in NIST Special Publication 800-30.
The OCTAVE methodology is a method that is used when assessing an organization 's information security needs. The most recently developed and

Get Access