A Technical History of the SEI

Information Security Assessments
The Challenge: Managing Risks to Enterprise-Wide Information Security
Before the era of pervasive computing, the major enterprise assets were tangible, such as buildings,
equipment, and physical products. Now intangibles are often the most critical assets [Webber
2000]—intangibles such as intellectual property, patient records, customer data, and other personally
identifiable information. When a security breach compromises critical assets, an
organization can suffer not only monetary loss but also loss of proprietary information, reputation,
and the public’s trust. Many government and commercial organizations have not identified or
placed a value on their intangible assets or assessed the risk to those assets, so they cannot know if
their important information is adequately protected or if resources are used to protect relatively
unimportant information. The lack of effective risk identification and management has an impact
on both the organization and on U.S. economic security.
A Solution: Managing Risks to Enterprise-Wide Information Security
The SEI began helping organizations identify software development risks in the early 1990s
through its Software Risk Evaluation (SRE). Prompted by the desire to help organizations better
identify cybersecurity risks, the SEI subsequently developed the Information Security Evaluation
(ISE). Drawing from SRE experiences, developers combined interviews with management and
staff (separately) with a technology evaluation to help organizations identify their assets and determine
their information security risks. The ISE team provided practical guidance along with its
findings.
The SEI subsequently documented best practices in CERT security improvement modules—modular
documents that contain concrete guidance for analyzing and improving specific aspects of security
on networked systems. The modules were developed from 1996 to 2001 and were subsequently
published in a book [Allen 2001]. 45 In parallel, starting in 1997, the SEI created a new
approach for managing cybersecurity risk—the Operationally Critical Threat, Asset, and Vulnerability
Evaluation (OCTAVE). Development was prompted by a combination of SEI experience
with the ISE and the Defense Health Information Assurance Program (DHIAP). 46 The SEI goal
was a self-directed risk assessment as part of the DoD effort to comply with the data security requirements
defined by the Health Insurance Portability and Accountability Act (HIPAA) of 1996.
The OCTAVE method incorporated the principles of ISE and continuous risk management. The
method was defined in a 1999 OCTAVE framework, the blueprint for the full method, released in
2001. First piloted with an SEI evaluation team, the OCTAVE method [Alberts 2003] became a
self-directed risk evaluation that meets the unique needs of each organization. It balances the organization’s
critical information assets, business needs, threats, and vulnerabilities, and also
benchmarks the organization against known good practice.
45 The CERT Guide to System and Network Security Practices has been translated into four languages.
46 DHIAP was a small consortium that included the SEI and the Advanced Technology Institute (ATI)
of the South Carolina Research Authority (SCRA) and was overseen by a group from the Telemedicine
Advanced Technology Research Center (TATRC) from Fort Detrick, Maryland.
CMU/SEI-2016-SR-027 | SOFTWARE ENGINEERING INSTITUTE | CARNEGIE MELLON UNIVERSITY 188
Distribution Statement A: Approved for Public Release; Distribution is Unlimited.