Risk Management: The Open Group Guide

Name: Risk Management: The Open Group Guide | The Open Group Guide
Brand: Van Haren Publishing BV
Price: 34.99 EUR
Availability: OnlineOnly

The Open Group Guide

Ian Dobson The Open Group(Author)

Van Haren Publishing BV

Published on 11. November 2011

137 pages

E-Book

PDF with Adobe-DRM

System requirements

978-90-8753-900-9 (ISBN)

€34.99incl. 7% vat

System requirements

for PDF with Adobe-DRM

E-Book Single Licence

Available for download

Description

Alles über E-Books | Antworten auf Fragen rund um E-Books, Kopierschutz und Dateiformate finden Sie in unserem Info- & Hilfebereich.

Alles über E-Books, Kopierschutz & Dateiformate finden Sie in unserem Info- & Hilfebereich.

This book brings together The Open Groups set of publications addressing risk management, which have been developed and approved by The Open Group. It is presented in three parts: The Technical Standard for Risk Taxonomy Technical Guide to the Requirements for Risk Assessment Methodologies Technical Guide: FAIR ISO/IEC 27005 Cookbook Part 1: Technical Standard for Risk Taxonomy This Part provides a standard definition and taxonomy for information security risk, as well as information regarding how to use the taxonomy. The intended audience for this Part includes anyone who needs to understand and/or analyze a risk condition. This includes, but is not limited to: Information security and risk management professionals Auditors and regulators Technology professionals Management This taxonomy is not limited to application in the information security space. It can, in fact, be applied to any risk scenario. This means the taxonomy to be used as a foundation for normalizing the results of risk analyses across varied risk domains. Part 2: Technical Guide: Requirements for Risk Assessment Methodologies This Part identifies and describes the key characteristics that make up any effective risk assessment methodology, thus providing a common set of criteria for evaluating any given risk assessment methodology against a clearly defined common set of essential requirements. In this way, it explains what features to look for when evaluating the capabilities of any given methodology, and the value those features represent. Part 3: Technical Guide: FAIR ISO/IEC 27005 Cookbook This Part describes in detail how to apply the FAIR (Factor Analysis for Information Risk) methodology to any selected risk management framework. It uses ISO/IEC 27005 as the example risk assessment framework. FAIR is complementary to all other risk assessment models/frameworks, including COSO, ITIL, ISO/IEC 27002, COBIT, OCTAVE, etc. It provides an engine that can be used in other risk models to improve the quality of the risk assessment results. The Cookbook enables risk technology practitioners to follow by example how to apply FAIR to other risk assessment models/frameworks of their choice.

More details

Other editions

Content

Intro
Preface
Acknowledgements
References
Introduction
Part 1 The Open Group Technical Standard
Risk Taxonomy
Chapter 1 Introduction to risk taxonomy
1.1 Scope
1.2 Purpose/objective
1.3 Context
1.4 The risk language gap
1.5 Using FAIR with other risk assessment frameworks
1.5.1 The ability of a FAIR-based approach to complement other standards
1.5.2 An example: using FAIR with OCTAVE
1.5.3 Conclusion
Chapter 2 Business case for a risk taxonomy
2.1 What makes this the standard of choice?
2.2 Who should use this Technical Standard?
2.3 Related dependencies
Chapter 3 Risk management model
3.1 Risk assessment approach
3.2 Why is a tightly-defined taxonomy critical?
Chapter 4 Functional aspects
4.1 What is defined?
4.2 What is in/out of scope and why?
4.3 How should it be used?
Chapter 5 Technical aspects
5.1 Risk taxonomy overview
5.2 Component definitions
5.2.1 Risk
5.2.2 Loss Event Frequency (LEF)
5.2.3 Threat Event Frequency (TEF)
5.2.4 Contact
5.2.5 Action
5.2.6 Vulnerability
5.2.7 Threat Capability
5.2.8 Control Strength (CS)
5.2.9 Probable Loss Magnitude (PLM)
5.2.10 Forms of loss
5.2.11 Loss factors
5.2.12 Primary loss factors
5.2.13 Secondary loss factors
Chapter 6 Example application
6.1 The scenario
6.2 The analysis: FAIR basic risk assessment methodology
6.2.1 Stage 1: Identify scenario components
6.2.2 Stage 2: Evaluate Loss Event Frequency (LEF)
6.2.3 Stage 3: Evaluate Probable Loss Magnitude (PLM)
6.2.4 Stage 4: Derive and articulate risk
6.3 Further information
Appendix A Risk taxonomy considerations
A.1 Complexity of the model
A.2 Availability of data
A.3 Iterative risk analyses
A.4 Perspective
Part 2 The Open Group Technical Guide
Requirements for riskassessment methodologies
Chapter 1 Introduction to requirements for risk assessment methodologies
1.1 Business case for risk assessment methodologies
1.2 Scope
1.3 Using this Technical Guide
1.4 Definition of terms
1.5 Key operating assumptions
Chapter 2 What makes a good risk assessment methodology?
2.1 Key component: taxonomy
2.2 Key risk assessment traits
2.2.1 Probabilistic
2.2.2 Accurate
2.2.3 Consistent (repeatable)
2.2.4 Defensible
2.2.5 Logical
2.2.6 Risk-focused
2.2.7 Concise and meaningful
2.2.8 Feasible
2.2.9 Actionable
2.2.10 Prioritized
2.2.11 Important note
Chapter 3 Risk assessment methodology considerations
3.1 Use of qualitative versus quantitative scales
3.1.1 When is using numbers not quantitative?
3.2 Measurement scales
3.2.1 Nominal scale
3.2.2 Ordinal scale
3.2.3 Interval scale
3.2.4 Ratio scale
3.2.5 Important note
3.3 How frequent is 'likely'?
3.4 Risk and the data owners
Chapter 4 Assessment elements
4.1 Identifying risk issues
4.1.1 Interviews and questionnaires
4.1.2 Testing
4.1.3 Sampling
4.1.4 Types of sampling
4.2 Evaluating the severity/significance of risk issues
4.3 Identifying the root cause of risk issues
4.4 Identifying cost-effective solution options
4.5 Communicating the results to management
4.5.1 What to communicate
4.5.2 How to communicate
Part 3 The Open Group Technical Guide
FAIR-ISO/IEC 27005 Cookbook
Chapter 1 Introduction to the FAIR-ISO/IEC 27005 Cookbook
1.1 Purpose
1.2 Scope
1.3 Intended audience
1.4 Operating assumptions
1.5 Using this Cookbook
Chapter 2 How to manage risk
2.1 Information Security Management System (ISMS) overview
2.2 How FAIR plugs into the ISMS
2.3 Major differences in approach
2.4 Recommended approach
2.5 Points to consider
2.5.1 Concerns about the complexity of the model
2.5.2 Availability of data to support statistical analysis
2.5.3 The iterative nature of risk analyses
Chapter 3 What information is necessary for risk analysis?
3.1 Introduction to the landscape of risk
3.2 Asset landscape
3.2.1 ISO definition and goal
3.2.2 Major differences in asset landscape treatment
3.3 Threat landscape
3.3.1 ISO definition and goal
3.3.2 Major differences in threat landscape treatment
3.3.3 Structure of classification
3.3.4 Consideration of threat actions
3.3.5 The development of metrics for the threat landscape
3.4 Controls landscape
3.4.1 ISO definition and goal
3.4.2 Major differences in controls landscape treatment
3.4.3 Development of metrics for the controls landscape
3.5 Loss (impact) landscape
3.5.1 ISO definition and goal
3.5.2 Major differences in loss (impact) landscape treatment
3.5.3 Structure of classification
3.5.4 Development of metrics for the loss (impact) landscape
3.5.5 Probability of indirect operational impacts
3.6 Vulnerability landscape
3.6.1 ISO definition and goal
3.6.2 Major differences in vulnerability landscape treatment
3.6.3 Consideration for the vulnerability landscape
3.6.4 Development of metrics for the vulnerability landscape
Chapter 4 How to use FAIR in your ISMS
4.1 Recipe for ISO/IEC 27005 risk management with FAIR
4.2 Define the context for information security risk management
4.2.1 General considerations
4.2.2 Risk acceptance criteria
4.3 Calculate risk
4.3.1 Stage 1
4.3.2 Stage 2
4.3.3 Stage 3
4.3.4 Stage 4
4.4 Determine the appropriate information risk treatment plan
4.5 Develop an information security risk communication plan
4.6 Describe the information security risk monitoring and review plan
Appendix A Risk Management Program Worksheet
A.1 Define the context for information security risk managementGeneral considerations
A.2 Calculate risk
A.3 Determine the appropriate information risk treatment plan
A.4 Develop an Information Security Risk Communication Plan
A.5 Describe the Information Security Risk Monitoring and Review Plan
Glossary
Index

Content (PDF)

System requirements

Save as PDF Copy link into clipboard

Schweitzer Fachinformationen

Risk Management: The Open Group Guide

Description

More details

Other editions

Additional editions

Content

System requirements