1. Lecture 6 OCTAVE

2. Octave Why? OCTAVE Other Evaluations Organization evaluation
Key Differences Between OCTAVE and Other Approaches
OCTAVE
Other Evaluations
Organization evaluation
System evaluation
Focus on security practices
Focus on technology
Strategic issues
Tactical issues
Self direction
Expert led

3. Examples

4. Examples

5. Example 1 Risks: Cost to correct data: $1,000,000
disclosure of company confidential information,
computation based on incorrect data
Cost to correct data: $1,000,000
@10%liklihood per year: $100,000
Effectiveness of access control sw:60%: -$60,000
Cost of access control software: +$25,000
Expected annual costs due to loss and controls:
$100,000 - $60,000 + $25,000 = $65,000
Savings:
$100,000 - $65,000 = $35,000 5

6. Example 2
Control cost
Hardware +$10,000
Software +$4,000
Support personnel +$40,000
Annual cost $54,000
Expected annual cost ( ) $54,000
Savings (6000 – 54,000)
-$48,000 6

7. Example 1: Risk = Likelihood x Impact

8. Example 2: Risk Rating Matrix 1

9. Example 3: Risk Rating Matrix 2

10. References
Joseph G. Boyce Dan W. Jennings, Information Assurance - Managing Organizational IT Security Risks, Elsevier Science, 2002

11. Wise man looking on us