1. Risk Assessment in NORDUnet
[TLP:GREEN]
Jacob Wolf

2. Why risk assessment? Treat risks that matters
Implement only necessary security
Report risk correctly
Assign risk responsibility
Take better business decisions

3. Method As mentioned on our last meeting, I use OCTAVE Allegro.
Benefits:
Easy security-business alignment
Structured, quantitative and qualitative
Easy reporting
Disadvantages:
No good tools. I had to invent my own.
Workflow:
Analyze what risks management priorities
Describe environment
Processes
Critical information (data that is key to the process)
Containers (technical, human, physical artifacts that handle the information)
Threats
Analyze each threat
Threats are scored regarding impact and likelihood.
Decide actions
Action (transfer, modify, accept, defer, ..)
Select controls for each affected container

4. I talked about my tool at our last meeting Since last meeting, I have:
Improved data structure
Created a web application (easier to use)
Soon, I will publish it on github

5. Example
I will now show the risk tool.

6. The Future?
I haven't migrated all my risk analysis to the new tool. This will follow very soon.
I will be happy to share generic risk analysis that could benefit this group (as [TLP:Amber]).