Introducing OCTAVE Allegro - Software Engineering Institute ...

2.4.2.2 Defining and using information asset security requirements
Security requirements—confidentiality, integrity, and availability—are part of an information
asset’s DNA. They are the asset’s requirements for protection and sustainability [Caralli 2007].
Regardless of where the asset is stored, transported, or processed, or who has custodianship of it
(either inside or outside of the organization), the asset’s security requirements live with it
throughout its useful life.
By confining the assignment of security requirements to information assets, OCTAVE Allegro
reduces the potential confusion around the definition and application of security requirements in
the risk assessment process. In the existing OCTAVE methods, security requirements are not specifically
related to information assets (as they are intended to be), and thus users often develop
and attempt to apply these concepts to “people” and “technology.” This causes some users to have
problems in risk identification and analysis. Furthermore, security requirements are a foundational
element for devising and implementing risk mitigation plans. OCTAVE Allegro explicitly requires
users to consider the implication of risk consequences on security requirements and in the
mitigation of risk.
2.4.3 Threat Identification Streamlined
The existing OCTAVE methods use threat trees as a guide for identifying threats. While threat
trees provide a structured means for identifying and considering various threat scenarios, they can
sometimes be confusing to use, especially for users with limited risk management experience. For
example, each path in an OCTAVE threat tree is a generic articulation of a threat; to make effective
use of these trees, participants in an OCTAVE assessment must become adept at translating
these generic paths to real-world scenarios. When users fail to make this translation, it significantly
affects the robustness of the identification of threats and risks.
In addition, users often fail to realize that each path in the threat trees may equate to one or more
than one real-world scenario. This is important because even though many threats share the same
underlying actor, motive, and outcome, they may require significantly different considerations for
mitigation. Over-reliance on threat trees for threat identification (in lieu of active discussion and
scenario development) can significantly diminish the overall effectiveness of the risk assessment
process.
OCTAVE Allegro uses threat scenario questionnaires rather than threat trees to help users identify
the threats associated with an information asset. These questionnaires are based on the threat trees
included in the OCTAVE method and thus ensure a broad consideration of potential threats.
However, the questionnaires are designed around the container concept to focus users on the
threats that are relevant to an information asset when it is stored, transported, or processed in a
specific container. This simplifies the structure of the questionnaire and reduces the overall time
required to capture a robust collection of potential threats.
2.4.4 “Practice” View Eliminated
The surveys of an organization’s current information security practices have been eliminated in
OCTAVE Allegro. While these practice surveys provide useful information to the OCTAVE
process (because they are considered in developing an organizational protection strategy), they
12 | CMU/SEI-2007-TR-012