Introducing OCTAVE Allegro: Improving the Information Security Risk Assessment Process

Abstract

ix .4 Obtaining Feedback and Direction 30Appendix A OCTAVE Allegro Method Guidance v1.0 31Step 1 -Establish Risk Measurement Criteria 32Step 2 -Develop an Information Asset Profile 34Step 3 -Identify Information Asset Containers 40Step 4 -Identify Areas of Concern 46Step 5 -Identify Threat Scenarios 48Step 6 -Identify Risks 53Step 7 -Analyze Risks 55Step 8 Tables Table 1: OCTAVE Timeline 2 The development, piloting, and codification of the OCTAVE Allegro method would not have been possible without the generous input, collaboration, and determination of the employees of Clark County, Nevada. The CERT Program has developed a special relationship with this organization over the past few years, and their willingness to try new methods, provide us with useful feedback, and help to refine techniques that can be used by many organizations is unparalleled. In particular, we would like to thank Michael Smith, IT Security Administrator, who has been a champion for the development and institutionalization of OCTAVE Allegro at Clark County and who has consistently strived to improve the organization's security and resiliency. We have been fortunate to work with him in a challenging and rewarding environment such as Clark County. List ofThe authors would like to thank ictQATAR and Q-CERT for their support in the refinement and transition of the OCTAVE Allegro methodology.We would also like to thank Jonathan Coleman, Visiting Scientist in the CERT Program, for his expert review and comments. As one of the original users of the OCTAVE method, Jonathan has extensive real-world knowledge that has been very valuable to us in developing OCTAVE Allegro.Last but certainly not least, the authors would like to thank Pamela Curtis, who consistently provides the SEM team with high-quality editing services and who is willing to teach us rather than to correct us. Through her work, she has had a profound effect on our writing and editing skills. AbstractThis technical report introduces the next generation of the Operationally Critical Threat, Asset, and Vulnerability Evaluation (OCTAVE) methodology, OCTAVE Allegro. OCTAVE Allegro is a methodology to streamline and optimize the process of assessing information security risks so that an organization can obtain sufficient results with a small investment in time, people, and other limited resources. It leads the organization to consider people, technology, and facilities in the context of their relationship to information and the business processes and services they support. This report highlights the design considerations and requirements for OCTAVE Allegro based on field experience with existing OCTAVE methods and provides guidance, worksheets, and examples that an organization can use to begin performing OCTAVE Allegro-based risk assessments.

Resolving vulnerability identification errors using security requirements on business process models

“…Using system scanning tools would improve identifying technical issues in the SRA, but tool-based vulnerability identification is time-consuming and momentum is lost (Caralli et al, 2007).…”

“…In the approaches of InnerhoferOberperfler and Breu (Innerhofer-Oberperfler and Breu, 2006), Operationally Critical Threat, Asset, and Vulnerability Evaluation (OCTAVE) (Alberts et al, 2003), OCTAVE Allegro (Caralli et al, 2007), conditions or situations that can threaten an organization's information assets" (Caralli et al, 2007): 18) can be used for vulnerability identification. In NIST SP 800-30 (Stoneburner et al, 2002), vulnerability knowledge bases, system security testing and a security requirements' checklist are all used for vulnerability identification.…”

A process-based dependency risk analysis methodology for critical infrastructures

“…Several RA methodologies and tools have been developed; some focus on the assets (CRAMM, 2010;Caralli et al, 2007; http://www.ar-tools.com/en/tools/pilar/) and others on the business processes (de Haes and Debreceny, 2013;Simonsson et al, 2007). Other methodologies focus on the risk derived from CI dependencies (Stergiopoulos et al, 2016a;Kotzanikolaou et al, 2013aKotzanikolaou et al, , 2013bKotzanikolaou et al, , 2013cAlpcan and Bambos, 2009) and their potential cascading effects.…”

“…Asset-based methodologies like MAGERIT, CORAS and MEHARI involve their users in the assessment (Amutio et al, 2014;CLUSIF, 2010;CORAS, 2010). CRAMM, OCTAVE and RiskSafe require extensive standardised documentation throughout RA to ensure traceability of results (CRAMM, 2010;Platinum Squared, 2014;Caralli et al, 2007). In addition, each of these RA methods demands a knowledgeable team (analysts, system administrators, users, etc.)…”

On the Equivalence Between Graphical and Tabular Representations for Security Risk Assessment

“…Most academic approaches suggest a graphical notation, starting from the seminal work on Anti-Goals [1] to [2] and more recently [3]. Industry opts for tabular models like OCTAVE [4], ISO 27005 and NIST 800-30. Microsoft STRIDE [5] is the exception on the industry side and SREP [6] is the exception on the academic side.…”