Measuring Information Security Risk

Measuring Information Security Risk Metricon 1 1 August 2006 Bob Blakley blakley@burtongroup.com

Measurements are not Metrics • Metricsare a system of parameters or ways of quantitative and periodic assessment of a process that is to be measured, along with theprocedures to carry out such measurementand theprocedures for the interpretationof the assessmentin the light of previous or comparable assessments. • - Wikipedia

Measuring Risk estimate probability and consequence Mitigate estimate log(probability) and consequence Mitigate & Recover estimate worst-case consequence Recover high impact estimate probability and consequence Mitigate ignore ignore low impact common uncommon rare

If you can’t measure one thing, you might be able to measure two

Risk Correlates: Vital Signs It’s hard to make you sick without changing your pulse, temperature, or blood pressure.

Differential Diagnosis

Measuring Information Security Risk

Measuring Information Security Risk

Presentation Transcript

Measuring Credit Risk

Unit Outline Information Security Risk Assessment

Information Security Risk Assessments

Information Security Compliance and Risk Management Institute:

Information Security Risk Management Solutions

Information Security Risk Evaluations and OCTAVE

Unit Outline Information Security Risk Assessment

Measuring systemic risk

Unit Outline Information Security Risk Assessment

Measuring Information

Information Security Risk Assessment and Plans

Information Security and Risk Management

IT Security Metrics A Practical Approach to Measuring Information Security:

Unit Outline Information Security Risk Assessment

Information Security Risk Management

Information Security is Information Risk Management

INF30020 Information Systems Risk & Security Case Study

Information Security : Risk Assessment and Treatment

Information Security Risk Assessment and Plans

Measuring Information Security