Understanding the Security Vulnerability Assessment Copyright Jean Perois, CPP, PSP, FSyI

‘ Have a clearer picture of what the SVA (API Methodology) is about, understand what it can do for you, but also evaluates both its strengths and limits.’ Copyright Jean Perois, CPP, PSP, FSyI Today’s objectives:

Security Audit Risk Assessment Security Survey Copyright Jean Perois, CPP, PSP, FSyI

What is an SVA? The SVA is a systematic process that evaluates the likelihood that a threat against a facility will be successful. Copyright Jean Perois, CPP, PSP, FSyI

What can the SVA do for you? 1. Full assessment of the security posture of your company 2. It measures vulnerabilities against threats 3. It identifies security gaps 4. Recommendations are commensurate to security risk Copyright Jean Perois, CPP, PSP, FSyI

* Based on Vulnerability, Threat & Attractiveness variables

Copyright Jean Perois, CPP, PSP, FSyI

Vague, unscientific and outdated Vague, unscientific and outdated R = P x C versus R = P A * (1 - P E ) * C R = P x C versus R = P A * (1 - P E ) * C where P A is the likelihood of adversary attack,, P E is security system effectiveness,1 - P E is adversary success, and C is consequence of loss of the asset.But The SVA addresses the full spectrum of mitigation measures The SVA addresses the full spectrum of mitigation measures Security remains a conceptual exercise and about educated guesses and probabilities Security remains a conceptual exercise and about educated guesses and probabilities Using equations will not change the reality of Risk Using equations will not change the reality of Risk

Copyright Jean Perois, CPP, PSP, FSyI