The Open FAIRT Body of Knowledge - A Pocket Guide
Published on 1. January 1970
117 pages
978-94-018-0561-2 (ISBN)
Description
This pocket guide provides a first introduction to the Open FAIR Body of Knowledge. It will be of interest to individuals who require a basic understanding of the Open FAIR Body of Knowledge, and professionals who are working in roles associated with a risk analysis project, such as those responsible for information system security planning, execution, development, delivery, and operation.
The Open FAIR Body of Knowledge provides a taxonomy and method for understanding, analyzing and measuring information risk. The outcomes are more cost-effective information risk management, greater credibility for the information security profession, and a foundation from which to develop a scientific approach to information risk management. This allows organizations to:
Speak in one language concerning their risk
Consistently study and apply risk analysis principles to any object or asset
View organizational risk in total
Challenge and defend risk decisions
The audience for this Pocket Guide is:
Individuals who require a basic understanding of the Open FAIR Body of Knowledge
Professionals who are working in roles associated with a risk analysis project, such as those responsible for information system security planning, execution, development, delivery, and operation
Risk analysts who are looking for a first introduction to the Open FAIR Body of Knowledge
More details
Other editions
Additional editions
Alex M. Andrew | Van Haren Publishing
The Open Fair Body of Knowledge
Book
11/2014
Van Haren Publishing BV
€40.99
No shipping information available
Content
- Intro
- Colofon
- Preface
- About the Authors
- Trademarks
- Acknowledgements
- References
- Chapter 1 Introduction
- 1.1 An Introduction to Risk Analysis and the Open FAIR
- 1.1.1 Risk Analysis: The Need for an Accurate Model and Taxonomy
- 1.1.2 Scenario - A Bald Tire
- 1.1.3 Why use the Open FAIR Body of Knowledge?
- 1.2 The Open FAIR Body of Knowledge
- 1.2.1 Relationship to Other Open Group Standards
- 1.2.2 Relationship to Other Risk Frameworks and Methodologies
- Chapter 2 Basic Risk Analysis Concepts
- 2.1 Basic Risk Analysis Concepts
- 2.1.1 Probability versus Possibility
- 2.1.2 Probability versus Prediction
- 2.1.3 The Risk Management "Stack"
- Chapter 3 Risk Taxonomy
- 3.1 Risk
- 3.1.1 Risk Taxonomy Overview
- 3.2 Loss Event Frequency (LEF)
- 3.2.1 Threat Event Frequency (TEF)
- 3.2.2 Vulnerability
- 3.3 Loss Magnitude
- 3.3.1 Primary Loss
- 3.3.2 Secondary Loss
- Chapter 4 Risk Terminology
- 4.1 Asset
- 4.2 Threat
- 4.3 Threat Communities
- 4.4 Threat Profiling
- 4.5 Secondary Stakeholders
- 4.6 Threat Event
- 4.6.1 Threat Event Types
- 4.6.2 Threat Vector
- 4.7 Loss Event
- 4.8 Primary Stakeholder
- 4.9 Loss Flow
- 4.10 Forms of Loss
- 4.11 Productivity Loss
- 4.12 Revenue Loss
- 4.13 Employee Productivity
- 4.14 Response Loss
- 4.15 Replacement Cost
- 4.16 Competitive Advantage Loss
- 4.17 Fines & Judgments (F&J) Loss
- 4.18 Reputation Damage
- 4.19 Controls
- 4.20 Avoidance Controls
- 4.21 Deterrent Controls
- 4.22 Vulnerability Controls
- 4.23 Responsive Controls
- Chapter 5 Measurement
- 5.1 Calibration
- 5.1.1 Starting with the Absurd
- 5.1.2 Decomposing the Problem
- 5.1.3 Testing Confidence using the Wheel
- 5.1.4 Challenging Assumptions
- 5.2 Distributions
- 5.3 Most Likely Values
- 5.4 Monte Carlo Simulations
- 5.5 Accounting for Uncertainty
- 5.5.1 Range Confidence
- 5.5.2 Curve Shaping
- 5.6 Accuracy versus Precision
- 5.7 Subjectivity versus Objectivity
- 5.8 Deriving Vulnerability
- 5.8.1 Threat Capability (TCap) Continuum
- 5.8.2 Defining a Threat Community TCap Distribution
- 5.9 Ordinal Scales
- Chapter 6 Risk Analysis Process
- 6.1 Assumptions
- 6.2 Scoping and Definition
- 6.2.1 Identify the Asset at Risk
- 6.2.2 Identify the Threat Community
- 6.2.3 Identify the Loss Event
- 6.2.4 Scenario Parsing
- 6.2.5 Identify and Clearly Define Scenario Objectives
- 6.3 Documenting Rationale
- 6.4 Choosing the Abstraction Level
- 6.4.1 Data Quality
- 6.5 Finding Data
- 6.6 Troubleshooting Analyses
- 6.7 An Example Analysis
- 6.7.1 Evaluating Loss Event Frequency (LEF)
- 6.7.2 Evaluating Loss Magnitude (LM)
- 6.7.3 Deriving and Articulating Risk
- Chapter 7 Risk Analysis Results
- 7.1 Interpreting Results
- 7.2 Communicating Results
- 7.2.1 Applying Qualifiers to Results
- 7.2.2 Translating Quantitative Results into Qualitative Statements
- 7.2.3 Capacity and Tolerance for Loss
- Appendix A Open FAIR Certification
- Appendix B Glossary
- Index
