Introducing OCTAVE Allegro - Software Engineering Institute ...

• minimizing the size and complexity of processes that must be learned and applied
• reducing the amount of data that must be collected and managed throughout the process
• controlling the number and variety of worksheets that must be completed
• focusing the process on a definable and manageable information asset scope
Reducing the inherent challenges imposed by the mechanics of existing OCTAVE methods ensures
that the process is focused on the risk assessment activity and the identification and analysis
of information security risks rather than satisfying an extensive set of guidelines and activities.
2.3.2 Refining Asset Scope
Accurately defining the scope of a risk assessment not only improves the results of the assessment
but results in potentially less overall effort. Thus, a primary requirement for OCTAVE Allegro is
to allow users to focus on the assets that are most important by ensuring they are selected for review
through a systematic and consistent process. By focusing on information assets exclusively
and other assets such as people, technology, and facilities through association with information
assets, the organization has a better opportunity to define a manageable scope from the outset,
thereby potentially reducing the effort required for threat identification, analysis, and mitigation
planning.
2.3.3 Reducing Knowledge and Training Requirements
An updated OCTAVE approach should lend itself more readily to institutionalization. One way
that this can be achieved is by reducing the required levels of knowledge and training necessary
for performing effective risk assessment. Minimizing the amount of risk management and information
technology knowledge required effectively increases the pool of personnel who can participate
in the assessment process with little investment in training and mentoring. Reduced
knowledge and training requirements not only lower overhead costs associated with risk assessment
but increase the potential institutionalization of the methodology throughout the organization.
In addition, in the case of regulatory compliance, the ability to train more people to perform
risk assessment effectively improves the organization’s overall capability for managing compliance.
2.3.4 Reducing Resource Commitments
Risk assessment is an essential organizational activity, but a resource-intensive assessment method
may not be cost effective enough to justify the investment of people and other resources. To
optimize the use of resources, an updated OCTAVE approach should
• be less difficult to use (by reducing required process activities to only those that are meaningful)
• require less data manipulation (by improving process flow, the staging of activities, and the
amount and type of data collected)
• streamline processes for identifying and mitigating risk (by focusing on information assets
exclusively, improving threat identification methods, and improving the way in which risks
are documented and analyzed)
SOFTWARE ENGINEERING INSTITUTE | 9