IT risk assessment frameworks: real-world experience
Formal risk assessment methodologies try to take guesswork out of evaluating IT risks. Here is real-world feedback on four such frameworks: OCTAVE, FAIR, NIST RMF, and TARA.
By Bob Violino
May 03, 2010 — CSO —
Assessing and managing risk is a high priority for many organizations, and given the turbulent state of information security vulnerabilities and the need to be compliant with so many regulations, it's a huge challenge.
Several formal IT risk-assessment frameworks have emerged over the years to help guide security and risk executives through the process. These include:
- Operationally Critical Threat, Asset and Vulnerability Evaluation (OCTAVE)
- Factor Analysis of Information Risk (FAIR)
- the National Institute of Standards and Technology's (NIST) Risk Management Framework (RMF)
- Threat Agent Risk Assessment (TARA), a recent creation
Here's a look at these key frameworks and some of their strengths and weaknesses, with emphasis on input from those who have used them in real-world settings.
OCTAVE (Operationally Critical Threat, Asset and Vulnerability Evaluation), developed at the CERT Coordination Center at Carnegie Mellon University, is a suite of tools, techniques and methods for risk-based infosec strategic assessment and planning.
OCTAVE defines assets as including people, hardware, software, information and systems. There are three models, including the original, which CERT says forms the basis for the OCTAVE body of knowledge and is aimed at organizations with 300 or more employees; OCTAVE-S, similar to the original but aimed at companies with limited security and risk-management resources; and OCTAVE-Allegro, a streamlined approach to information security assessment and assurance.
The framework is founded on the OCTAVE criteria—a standardized approach to a risk-driven and practice-based information security evaluation. These criteria establish the fundamental principles and attributes of risk management.
The OCTAVE methods have several key characteristics. One is that they're self-directed: Small teams of personnel across business units and IT work together to address the security needs of the organization. Another is that they're designed to be flexible. Each method can be customized to address an organization's particular risk environment, security needs and level of skill. A third is that OCTAVE aims to move organizations toward an operational risk-based view of security and addresses technology in a business context.
Among the strengths of OCTAVE is that it's thorough and well documented, says Brooke Paul, managing director at Capital Informatics and former CSO at American Financial Group. "The people who put it together are very knowledgeable," says Paul, who has evaluated the framework for clients. "It's been around a while and is very well-defined and freely available."
Because the methodology is self-directed and easily modified, it can be used as the foundation risk-assessment component or process for other risk methodologies, says Ron Woerner, security systems analyst at HDR, an architectural and engineering firm. Woerner says he's used a hybrid of OCTAVE, FAIR and other methodologies.
"The original OCTAVE method uses a small analysis team encompassing members of IT and the business. This promotes collaboration on any found risks and provides business leaders [with] visibility into those risks," Woerner says. "To be successful, the risk assessment-and-management process must have collaboration."
In addition, OCTAVE "looks at all aspects of information security risk from physical, technical and people viewpoints," Woerner says. "If you take the time to learn the process, it can help you and your organization to better understand its assets, threats, vulnerabilities and risks. You can then make better decisions on how to handle those risks."
Experts say one of the drawbacks of OCTAVE is its complexity. "When it shipped, we spent hours trying to understand what it was that this package was going to do for us," says Adam Rice, global CSO and vice president of managed security services at Tata Communications, a provider of communications services.
"There was a lot of time taken up just trying to understand what the approach was, because it wasn't very clear to me," Rice says. "Anything that takes a lot of time detracts from its use."
Paul adds that a downside to OCTAVE is that it doesn't allow organizations to mathematically model risk. "It's a qualitative methodology, like most others available today," he says.
Next page: the FAIR methodology