Risk Management Blog - All Comments

re: Getting Back on the Horse

janko — Sat, 22 May 2010 21:56:11 GMT

It is good you are back on the horse! hh: )

re: Risk Assessment Methodology Update

ebellis — Tue, 02 Dec 2008 15:09:05 GMT

Any thoughts of getting this back up and running? The content is getting a little stale,I'd be happy to help out where I can.

re: State of Risk Management in ISM-Community

rybolov — Sat, 23 Jun 2007 00:11:58 GMT

Yes sir. There are many ways to "skin a cat" but basically most risk management methodologies are the same at the core. =)

re: State of Risk Management in ISM-Community

erichnewell — Fri, 22 Jun 2007 20:12:14 GMT

So as to not re-invent the wheel, be sure to look at the IAM and IEM produced by the NSA.

Developed in 1998, the National Security Agency INFOSEC Assessment Methodology is pretty robust and still relevant. The book <i>"Security Assessment: Case Studies for Implementing the NSA IAM"</i> covers the NSA IAM in a logical progression and draws from 800-30 among others.

I recommend it highly along with the NSA IEM as well.

Drawing from these to bodies should go a long way towards development of a heuristic methodology.

ISM RA Methodology « Mark Curphey - SecurityBuddha.com

ISM RA Methodology « Mark Curphey - SecurityBuddha.com — Fri, 22 Jun 2007 05:49:13 GMT

Pingback from ISM RA Methodology « Mark Curphey - SecurityBuddha.com

re: Getting Back on the Horse

mcurphey — Fri, 22 Jun 2007 05:44:42 GMT

File upload works. It was your user error ;-)

The Guerilla CISO » Blog Archive » Call for Volunteers

The Guerilla CISO » Blog Archive » Call for Volunteers — Fri, 22 Jun 2007 02:51:26 GMT

Pingback from The Guerilla CISO » Blog Archive » Call for Volunteers

re: State of Risk Management in ISM-Community

mcurphey — Wed, 02 May 2007 16:54:35 GMT

Superb Monsieur Guerilla.

I think you are spot on about the lack of simple tools to support RA.

Also it may be worth us digging up the list we came uo with of the Current Issues with RA. If I recall there was a uninimous vote for something that was super fast and reasonably accurate (qualitative) rather than something that took a while to compute and was better.