OCTAVE Allegro Risk Framework: A Comprehensive Guide

This article provides a comprehensive guide to the OCTAVE Allegro Risk Framework, including its history, methodology, and requirements for usage. The OCTAVE Allegro approach helps organizations identify, manage, and evaluate security risks by focusing on information assets and their exposure to threats, disruptions, and vulnerabilities. The article also discusses the benefits of using the OCTAVE Allegro approach and future works for evolving the technique.

Running head: RISK FRAMEWORK
Risk Framework
Name of Student-
Name of University-
Author’s Note-

1RISK FRAMEWORK
Table of Contents
1. Introduction..................................................................................................................................3
1.1 OCTAVE Risk Framework...................................................................................................3
1.2 History of OCTAVE Framework..........................................................................................4
1.3 Introduction to OCTAVE ALLEGRO...................................................................................4
2. Evolving the OCTAVE Method..................................................................................................5
2.1 Experience Using OCTAVE Method....................................................................................5
2.2 Need of OCTAVE Allegro Method.......................................................................................5
2.3 Requirements for using OCTAVE Allegro...........................................................................6
3. Roadmap of OCTAVE Allegro...................................................................................................6
4. Using the OCTAVE Allegro Risk Framework..........................................................................10
4.1 Preparing the Octave Allegro..............................................................................................10
4.1.1 Obtain Sponsorship of the Senior Management...........................................................10
4.1.2 To Allocate Organizational Resources.........................................................................11
4.1.3 Requirements for Training............................................................................................11
4.2 Performing the Assessment.................................................................................................11
4.2.1 To Select Information Assets........................................................................................12
4.2.2 To Develop the Criteria of the Risk Measurement.......................................................12
4.2.3 To Repeat the Assessment............................................................................................12
5. Benefits of Risk Assessment with OCTAVE Allegro...............................................................13
6. Future Works and Conclusion...................................................................................................13
5.1 Evolving the Technique of Octave Allegro.........................................................................14
5.1.1 To Focus on the Organizational Processes and the Services........................................14
5.1.2 Expanding View beyond the Operational Unit.............................................................14
5.1.3 Applying the OCTAVE Allegro in SDLC....................................................................15
5.2 Looking Forward in Future..................................................................................................15
5.2.1 Expanding Interest Community....................................................................................15
5.2.2 Exploring Connections in CERT Resiliency Framework.............................................16
5.2.3 Updating as well Improving Training...........................................................................16
References......................................................................................................................................17

2RISK FRAMEWORK
1. Introduction
Management of risk and mitigation of risk is basically a process that is used to identify,
access as well as mitigate the scope of the risks, the schedule, quality, and the cost of the risk in a
project. There are many opportunities as well as threats from where the risk comes from and the
risks are scored on their occurrence probability as well as impact of the project (Wangen,
Christoffer and Einar). The planning that is done for mitigating the risk is basically a process that
develops the options as well as actions for enhancing the opportunities as well as reducing the
threats related to project objectives. Implementation of the risk mitigation is considered as a
process that executes the action to be taken for risk mitigation. The monitoring of risk mitigation
involves the risks tracked are identified, along with identifying many new risks as well as
evaluating the effectiveness of risk process all through the project.
For having a better management of risk as well as mitigation roadmaps, many of the
organizations have very high information security frameworks that would help to seize the
opportunities as well as achieve the strategic goals of the organization (Kawanishi et al.). One
framework that can be involved for getting high information security is Operationally Critical
Threat, Asset and Vulnerability Evaluation (OCTAVE). This approach is mainly built by the SEI
(Software Engineering Institute) for addressing all compliance challenges of information security
that are faced by the organizations.
The methodologies involved in OCTAVE are mainly created for tackling the challenges
of information security that are faced by (DoD) Department of Defense in U.S. The
methodologies of OCTAVE have various number of effectiveness and presently this particular
methodology is used by the public as well. The objective of the OCTAVE approach is helping
the organizations for ensuring the goals as well as objectives that are connected with activities of
information security.
1.1 OCTAVE Risk Framework
The methodology of risk assessment of OCTAVE approach is identifying the security
risks, managing them, as well as evaluating the information of the security risks. The OCTAVE
methodology mainly serves an organization in the following ways:
 Helps in developing the criteria of risk evaluation that helps in describing the operational
risk tolerance of the organization.
 Helps in identifying all assets needed for accomplishing the mission of the organization.
 Identifying the vulnerabilities as well as threats for all the assets.
 Determining as well as evaluating the consequences that are faced by the organizations if
there is threat in the organization.
 Initiating the continuous improvement of the actions for mitigating the risks.
The methodology of OCTAVE approach helps in directing the individuals responsible for
management of the operational risk of the organization (Wahlgren and Stewart 129-151). This
might include the business personnel of the organization of the business units, the person that are
involved in the information security or the conformity in the organization, the risk managers, and
the department of information technology as well as participation of the staff in activities of the
risk assessment with helps of the OCTAVE approach.
1.2 History of OCTAVE Framework

3RISK FRAMEWORK
For resolving the continuous issues related to the risk management, the SEI has
developed the first ever OCTAVE approach framework in the year 1999. This particular
framework included large corporations having 300 employees or more. The framework was then
having hierarchy of multi-layer as well as the framework is also responsible for managing the
software infrastructure in the organization (Ilvonen and Jari 270-281). The main evaluation
criteria that helps to use the framework are mainly based on an approach that is three phased.
The three phase approach includes technological view, Risk Analysis, and Organizational View.
In the year 2003, updating the original framework was developed and was then named as
the OCTAVE-S risk assessment framework. This particular approach was developed for the
small organizations having less than 100 employees having hierarchy that is flexible and can also
have team members that are specialized (Pan and Tomlinson 270-281). The approach containing
three phase is basically used in the approach of OCTAVE and is intended for the small teams in
the organization that can deal this approach.
Finally in the year 2007, the CERT team (Computer Emergency Response Team) is a
particular program conducted by SEI has updated the version of OCTAVE-S and named it as
OCTAVE Allegro. This approach is developed for the organizations that mainly focuses on the
information assets of how the framework will be used by the organization and how the
information is stored, processed as well as transported in the organization (Aries). The
organization also focuses on how their information assets are exposed to the threats, disruptions,
and vulnerabilities. The allegro version of the OCTAVE framework helps in reducing many
requirements as well as processes that helps in making the framework easy to use. The Allegro
approach helps in shifting the OCTAVE approach from asset centric technology to a risk
assessment that is based on the information.
1.3 Introduction to OCTAVE ALLEGRO
OCTAVE Allegro is basically considered as a methodology for restructuring as well as
optimizing the process of measurement included in the security risk for achieving the required
goal having small investment in the specified time, specified people, and include other resource
as well (Suroso and Rahadi). With the help of OCTAVE Allegro methodology, the organizations
helps in considering the people, facilities as well as technology in regards with the information,
services as well as business processes that are supported by the framework.
The OCTAVE Allegro mainly defines all critical components included in a framework of
risk assessment of the information security. This is mainly done by referring the risk with
availability, integrity as well as confidentiality of the assets. With this approach, the organization
will not have any problem to define the critical assets which can occur risk or the risk that are not
mentioned in the methodologies of the organizations (Wangen). The OCTAVE Allegro mainly
provides clear instruction about the way of identifying the critical assets in same time connected
with the organizational goals as well as objectives related to security goals as well as objectives.
The security teams included framework will mainly work together with operational teams for
addressing the needs of information security for protecting the critical data. The IT departments
of the organization will not take the critical decisions.
The organizations that includes the OCTAVE Allegro approach mainly requires the
profiles of information assets for having better as well as unambiguous definition for the asset
boundaries (Whitman). The profile helps to enable the organization in defining the security

4RISK FRAMEWORK
requirements, assigning the ownership as well as set the values. After the profiles being created,
the organizations can update as well as change the future assessments with respect to the need of
the organization.
2. Evolving the OCTAVE Method
2.1 Experience Using OCTAVE Method
There is wide range of the type of market, size of the market as well as business of the
market involved in the organization that are using the framework of the OCTAVE method. The
organizations have thus found many success for applying, institutionalizing as well as tailoring
the method either of the streamlined form or in the allegro form. These methods helps the
organization to have a risk assessment in their working process, their culture as well as
organizational structure (Meszaros and Buchalcevova 300-313). The main ability for connecting
the organizational goals as well as objectives for gaining goals of information security and
achieving the objective of the organization. The organizations can apply the approach of
OCTAVE framework mostly bring in operational as well as organizational view point
information for the activities of the risk management. This allows them to evolve the
vulnerability management as well as reactive the activities that comes toward the risk
management of information.
The main aspect of the OCTAVE method is mainly providing a perspective that is
interdisciplinary to risk identification, mitigation processes as well as risk assessment. The
workshop that is based on the data collection as well as analysis process of all the methods that
exits in OCTAVE method (Aminzade 9-11). This helps in bringing together all the disparate
groups in organization that comes for a common purpose. For this collaboration, all
organizations always exposes the issues that limits the ability for identifying as well as
mitigating the risks that includes:
 The gaps that occurs in the communication channels of the organization
 Different levels of understanding as well as communication of the policies that are
involved in the levels of organization.
 Gaps that are included in the practice as well as in the intended effects.
This aspect of the OCTAVE method also provides diversity understanding, opinions, as
well as experience that helps in strengthening the breadth and the quality of activities of risk
mitigation as well as risk assessment.
2.2 Need of OCTAVE Allegro Method
There are many organizations that deploys as well as institutionalize the OCTAVE
approach and the OCTAVE-S approach. But, these methods have become old by the year 2004
(Tøndel et al. 1-30). The risks from information security that are to be managed by the
organization as well as the capabilities of the organization helps in managing the changing risk
after introduction of the methods in the organization. There are many significant bodies of
knowledge that are acquired by applying as well as teaching the OCTAVE as well as observing
other companies using this method for improving its processes.
One of the main reason for the user centric risk assessment is to gain more centric
information of risk assessment. Organization mainly focus on the security assessment of the

5RISK FRAMEWORK
organization and all the other assets are easily bought in the process as the containers where all
information assets gets transported, processed or stored (Hariyanti, Arif and Daniel Oranova).
Example of container can be a person, a technology or an object. The threats included in the
information asset are mainly examined by the considering their place to live which limits the
total number as well as types of assets that are bought in the process. Emphasizing more focus on
the information asset limits the total amount of information that are actually gathered,
understood, and analyzed before performing a risk assessment.
With the given size of the method along with the complexity of method, it is clearly
understandable that the organizations face challenges for embracing the approach of OCTAVE
and using the approach of OCTAVE. Absorbing numerous number of pages containing the
process documentation, worksheet understanding and about how to use them, as well as the way
to collect and organize the data that are needed are mostly challenging task for the organizations.
There can be a sheer data collection volume for implementing the methods in the organization
and some of them also move forward with the task performing for analyzing as well as
mitigating the tasks.
Reflecting the knowledge as well as the insights that are acquired when the first
OCTAVE approach was implemented mainly indicates that with the updated approach to
perform security risk assessment is very important phase. This helps in forming the basis of
establishment while setting the requirements that is evolved from the OCTAVE approach. This
helps to meet the organization needs that are changing and are also capable of handling
operational risks that are more complex.
2.3 Requirements for using OCTAVE Allegro
The requirement that are needed for using the OCTAVE allegro approach does not only
describe what is to be built or the reason for it building up (Amini and Norziana). The
requirements provides way to measure whether particular activity is successful or not. First step
that is included to develop an OCTAVE approach in an updated version is capturing a design set
of requirements that is derived from the field use, the classroom experience, and the observation.
The requirements are listed below:
 Improving easy usage.
 Refining definition of scope of the assessment.
 Reduce the training as well as getting knowledge of requirements
 Reduce the resource commitments
 Encouraging repeatability as well as institutionalization
 Produce comparable as well as consistent result in the enterprise
 Facilitate the development of the risk assessment for competency
 Support the requirements of enterprise compliance
3. Roadmap of OCTAVE Allegro
The approach of OCTAVE Allegro is explained in this section and is designed in a way
that allows broad assessment that control the risk environment of the organization with goal that
produces result that is more robust without involving extensive knowledge of risk assessment.
This OCTAVE Allegro approach mainly differs from other approaches of OCTAVE that helps in
focusing all the information assets that are primarily needed (Kozlovs, Kristine and Marite). The

6RISK FRAMEWORK
information assets includes their usage, the way to store them, the place where they are stored, or
transported or is processed. The information asset also states about the threats, disruptions as
well as vulnerabilities that comes as a result. Same as the other previous methods, all OCTAVE
Allegro is to be performed in the workshop style and in collaborative setting. The OCTAVE
Allegro method is supported with proper guidance, questionnaires, as well as worksheets. This
particular method is also suited for the individuals who requires to perform the assessment of
risk without involvement of the extensive organization or expertise.
The approach of OCTAVE Allegro includes eight steps which are actually organized in
four phases that is shown in the figure 1 below. The diagram show four phase; phase 1 includes
the organizational development criteria of risk measurement that is consistent with the
organization drivers. In the phase 2, the information asset are actually determines to be a critical
one are profiled. This process of profiling mainly establishes boundaries that has clear asset,
identifies the security requirements, as well as identifies all other locations that stores the asset,
transports them as well as process them (Wangen et al.). In the 3rd phase, the threats included in
the information assets are mainly identified in their location context about the storing of asset,
transportation as well as processing of the asset. In the 4th phase, the risk faced by the
information asset are mainly to be identified as well as analyzed and their development for the
mitigation approaches are discussed.
For making the process of OCTAVE Allegro more easy to use, this particular approach
has reduced many requirements as well as complications that were present in the previous
OCTAVE and OCTAVE-S approach of risk assessment. The eight steps are show below divided
into four categories namely identify phase, analyze phase, assess phase, and mitigation of the
potential risks included. Relationship in the activity area as well as in actual methodology step
are shown below: All the phases of the OCTAVE Allegro approach are explained in the section
below along with the steps that are included in the phase.
Figure 1: Steps of OCTAVE Allegro
(Source: Kelo, Eronen, and Rousku 50)

7RISK FRAMEWORK
I. Establish Drivers – This phase of the OCTAVE Allegro only contains the few steps
that are to be taken by the organization that helps in developing the criteria of risk measurement
which are consistent with the drivers of the organization. These particular drivers can be used for
evaluating effects of risks for completing a mission of an organization and the concerned
objectives. The establish drivers includes all the criteria of risk measurement that an organization
needs to develop which are consistent with the drivers of the organization.
II. Profile Assets – The area of profile assets include the step 2 as well as has the step 3
which has the profiles of information asset that are created. After identifying the profiles as well
as creating the profiles, the containers of the assets are then identified and the profile for each of
the asset is then captured on one single worksheet. All the information asset are shown in a
profile describing the feature that are unique, their qualities, the characteristics as well as the
values that are included in the information asset.
III. Identify Threats – The identify threat phase contains step 4 and step 5 that addresses
the threats to information asset are actually identified as then they are documented following a
structured process (Kelo, Eronen and Rousku 50). In this particular strategy, the areas that are
mainly concerned includes scenarios of real life that occurs in the organization and the threat
scenarios which also has additional threats. To identify the threats that states the threats to be
asset are mainly identified and are then documented through a series of process.
IV. Identify and Mitigate Risks – The last phase of the OCTAVE Allegro roadmap is
mainly the risk assessment phase. The risks concerned with the information assets are identified
first and then they are analyzed that is based on the threat information as well as developing
mitigation strategies that addresses the risk identified. Identifying as well as mitigating the risks
are done mostly on the basis of threat information and the mitigation strategies are them
addresses for the risk analyzed.
The output of each of the phase are explained below which are actually explained in this
section.
Step 1 – To Establish the Risk Measurement Criteria
This is the first step in the process of OCTAVE Allegro that helps to establish the drivers
of organization usually used for evaluating all effects of risks in the mission of the organization
as well as achieving the objective of the business (Wangen et al.). All the drivers include gets
reflected in criteria of measuring the risk set that is then created as well as captured as initial part
of this step. The criteria of the risk measurement are actually same as the qualitative measures
that are taken against the effect of the risk that is evaluated as well as forming a foundation that
includes information asset risk assessment. With the use of consistent criteria of risk
measurement actually helps in reflecting the organizational view ensuring the decisions about the
way to mitigate them and are consistent over many information assets as well as operating or the
departmental units.
With the evaluation of the impact of risk over a particular specific area, the organization
helps to recognize all impact of the areas that are most significant to the mission of the business
as well as business objective (Kozlovs, Cjaputa, and Marite). In some of the organization, the
impact of the relationship with customer base is more significant that impacts on the compliance
with some regulations. The prioritization is given to the impact areas that is performed in this

8RISK FRAMEWORK
step of OCTAVE Allegro framework. There is a standard worksheet template set that is provided
in the OCTAVE Allegro method for creating the criteria that has several impacts as well as
prioritize them accordingly.
Step 2 – To Develop a Profile of Information Asset
The methodology of OCTAVE Allegro mainly focuses on the information asset in the
organization and in the step 2, the process for creating the profile of the assets are actually
involved in the process. The profile is actually a representation of information asset that is used
for describing the unique features, the qualities, the characteristics as well as the value of the
profile (Amini and Norziana). The profiling of the methodology is a process that mainly ensures
that the asset is described clearly and is described consistently. The profiling states that there is
unambiguous definition of the boundary of the asset and the requirement of security for asset is
then defined adequately. Profiling each asset is then captured on a single worksheet that forms
identification threat and the risks that are included in the steps.
Step 3 – To Identify the Information Asset Containers
The containers mainly describes places that includes the information asset that are stored,
processed as well as transported. The information asset is not only included in the containers
with the boundaries of organization but the information asset often reside in the containers that
are not controlled by the organization (Hariyanti, Arif and Daniel). The risks included in the
containers include lives of information asset that are mainly inherited by them.
The problem of storing in containers becomes more important factor if the contracts of
service provider are unknown to information asset owner. For gaining the adequate profile risk
of the information asset, the organization mainly identifies all locations which contains the
information assets that are stored, processed as well as transported or the information assets that
are not in direct control of the organization.
Step 4 –To Identify the Concern Areas
In the step 4, the process of risk identification actually begins with the brainstorming
including all the possible conditions or the situations which threaten the information asset of the
organization. The scenarios that are included in the real world are mainly referred as the areas for
concerning and can represents the threats as well as corresponding all the outcomes that are
undesirable (Tøndel et al. 1-30). The areas that are concerned actually characterize the threats
that are unique in the organization and the operating conditions that are involved. The main
purpose of this step is not capturing the complete list of the possible scenario threat for the
information asset. The idea of complete list consisting of all possible threat of the situation and
conditions that come in mind are of analysis team are captured very quickly.
Step 5 – To Identify the Threat Scenarios
In the first part of step 5, the captured area of concern that are considered in the first step
are actually expanded in threat scenarios. Those scenarios are then detailed in the properties of
the threat (Wangen, Christoffer, and Einar 1-19). The collection of the threats that are developed
from the concern areas necessarily does not always provide quick consideration of the possible
threats of information asset faced by the organization. In second part of Step 5, a wide range of
the additional threats are then considered after all the threat scenarios are examined.

9RISK FRAMEWORK
Step 6 – To Identify Risks
After the identification of the threats, in the next step, all the consequences of
organization are taken in to account if the threat realized is actually captured after completing
risk picture. There can be multiple impacts of a threat involved in an organization. For instance,
disruption of the e-commerce system of the organization mostly effects the reputation of the
organization with all the customers along with the financial position. All activities that are
involved in step 6 actually ensures the different consequences of the risks that are captured.
Step 7 – To Analyze Risks
In the 7th step of risk assessment, a quantitative measure is computed to an extent that
needs the impact of threat of organization (Kawanishi et al.). The relative risk score that is
derived while considering extent which consequences the risk impact of the organization that
comes against the relative importance for the different impact areas as well as the probability
involved. Reputation is one of the important factor that an organization needs to deal with and if
the reputation of the organization have risks, it might generate high score compared to other
equivalent risk in the organization. Giving priority to the impact criteria, the organization
actually ensures that the risks are prioritized in the drivers of the organization.
Step 8 – To Select the Mitigation Approach
In the last step of the risk assessment criteria, the final step included in the process of
OCTAVE Allegro is identifying all the mitigating process of the risks that are found previously
in the organization (Wahlgren and Kowalski 129-151). There is a need of mitigation as well as
developing the mitigation strategy of the organization. The risks that are identified in the risk
framework are first prioritize on the basis of the risk score. Once risks is prioritized, all the
mitigation strategies are actually developed for considering the value asset as well as considering
its security requirements.
4. Using the OCTAVE Allegro Risk Framework
4.1 To Prepare the Octave Allegro
Some of the preparation is actually necessary before performing risk assessment
OCTAVE Allegro in an organization. The activities preparation mainly includes obtaining the
management support, allocating the appropriate all resources of organization to process as well
as scoping the activities of assessment.
4.1.1 Obtain Sponsorship of the Senior Management
Obtaining the sponsorship from the senior management of an organization is actually a
critical factor that performs the assessment of the OCTAVE allegro successfully. With
involvement of OCTAVE Allegro methods included, the management needs to be committed to
provide all the active support included in the process and they should have the will in
participating in all the processes that are necessary for developing as well as sponsoring the
criteria of risk measurement of the organization (Ilona, and Jussila). The participation level of the
management should be minimized by the methodology of OCTAVE Allegro and that is to be
leveraged all through the organization.

10RISK FRAMEWORK
The senior management should also ensure that there should be a proper resource that are
to be allocated to all processes that enables the members of assessment teams for devoting
necessary time for performing all the process. The members included in assessment team are
developing the useful results from the process as well as using of resources from the team is not
available.
4.1.2 To Allocate the Organizational Resources
There are two important aspects that are included in the methodology of OCTAVE
Allegro. The two important aspects are the composition as well as size of assessment team (Pan
and Tomlinson). For establishing the assessment team, there should be range of possibilities that
are to be involved. In most of the cases, the senior staffs mainly performed all the method by
their own depending on the knowledge they have on operational area. The group of the people
from similar operational unit mostly have some collaboration on risk assessment. In many cases
it is included as a representative from the information technology who is responsible for
participating on team or is even directly responsible for accessing them is necessary (Aries).
Access to IT department is always necessary in the process of mapping for the information assets
as well as developing the scenarios related to threat as well as plans for risk mitigation. The IT
department is actually responsible for providing the technical depth that the other team member
cannot provide.
The commitment of time for process can differ widely mainly on availability, make-up of
team, as well as experience of team, complexity of all the resource asset, environment
complexity where the assets are mainly stored, or transported or is processed and the total count
of the information asset that is being reviewed (Suroso and Bayu). For the first time the team
performs assessment on a particular information resource that often take many days. As the team
gains more experience and learns how to efficiently divide all the tasks among the team
members, they can predict the total time required for completing a particular assessment. The
team can also gain more proficiency for performing the assessments given to them reducing all
the time commitments.
4.1.3 Requirements for Training
The organizations that have other working knowledge of the existing methods of
OCTAVE framework can pick up the guidance, questionnaires as well as worksheets that are
associated with the method and then deploy them without facing any challenge or delay. The
organization can perform their work very easily without any difficulty (Wangen 52-61). The
organizations or the organizational units that includes the risk assessment is actually is a new
activity or a particular area for improving is to provide some training or has to support the
assessment of the team members. For improvement, they actually needs to provide training as
well as support the assessment related to team members. The methodology of OCTAVE Allegro
is to be dated and for that the users are to become functional in method in a half day. it can be
noted that the methodology of OCTAVE Allegro is actually designed for self-applied as well as
the personnel of assessment team who would give guidance as well as worksheets that also
includes technical report.
4.2 Performing the Assessment

11RISK FRAMEWORK
The guidance, questionnaires and the worksheets are actually necessary for performing
the assessment of OCTAVE Allegro method. These particular artefacts are actually intended for
a noting the information asset for a single time (Whitman 52-61). The organization that has
more than one information asset will actually have to repeat the process many times for each of
the information asset that are included in the scope of the risk assessment.
4.2.1 To Select the Information Assets
To keep the methodology of OCTAVE Allegro up to date, the users have to exhibit some
difficulty for identifying all the information assets that are to be include in the scope of the
assessment. But the users sometimes face challenge for selecting the subset of the assets
involved critically to the organization. This actually needs some understanding of all the assets
that supports the critical processes of the organization. If selection of the information asset is
actually left on the team judgment assessment. The importance of resource is actually based on
perceived instead of giving more that are consistent and are repeatable method for the asset
valuation (Meszaros and Alena 300-313). Usage of the factors of critical success actually
provides more consistent as well as have repeatable method that has asset based on the perceived
value instead of having more consistent as well as repeatable method for valuation asset. The
critical factors that are used actually provides consistent as well as repeatable method for
validating as well as selecting the critical assets. To perform affinity analysis pool of the
information asset are actually mapped against the success factors of the organization. This helps
in identifying information asset that are actually important for meeting mission that is fixed by
the organization.
The analysis of success factors that are included in an organization actually provides
insights for performing the risk assessment in the organizational unit. The technical report of SEI
reports that Critical success factor that are included in the risk assessment is establishing a
Foundation for the Enterprise Security Management. This provides the methodology about how
the critical success factors are identified as well as notionally cites the process that uses all the
factors for identifying the assets of organization as well as units of the organizations.
4.2.2 To Develop the Criteria of the Risk Measurement
The first step that is included in OCTAVE Allegro involves the criteria for measuring the
risk factors included in the organization (Aminzade 9-11). The users mainly considers
development of the criteria as the iterative process for improvement over the time. For all the
cases, the criteria of risk measurement actually reflects the risk tolerance of the management and
the appetite and can also be applied universally across the organization to that extent that is
possible. The main result of the risk assessment is performed for different criteria of risk
measurement that are not comparable.
4.2.3 To Repeat the Assessment
The assessment of OCTAVE Allegro is repeated all the time that has a change in
significantly in the asset of risk environment (Sardjono and Cholik). Actually, operational
environment of the organization changes constantly and due to this assessment of OCTAVE
Allegro, the snapshot is actually needed and it can be updated quickly. The OCTAVE Allegro is
includes a snapshot that helps to update quickly.

12RISK FRAMEWORK
Some of the organizations mostly set up many regular schedule assessments for ensuring
all the changes included in environment of risk (Díaz and Mirna). For the changing
environments, this particular approach is very appropriate. But this approach is not accurate for
stable environments, cumulative effect of the small changes are actually required for the asset in
the risk environment. There are also some environments that are even possible for having
cumulative effect for the small changes in resource involved in risk environment. Some of the
organizations also find some hybrid approaches that fits in the operational environment. The
organizations determines the criteria for repeating the assessment of OCTAVE Allegro as well as
implementing the criteria that comes along the institutionalization of all the processes.
5. Benefits of Risk Assessment with OCTAVE Allegro
The methodologies included in the OCTAVE Allegro brings unique perspective that
includes the collaboration between the risk identification, mitigation, as well as assessment of the
organization. By bringing the importance as well as sensitivity of the data to IT teams, as well as
having proper communication to top management, the OCTAVE Allegro actually provides many
organizational connection within the companies that were absent before (Yang et al. 21-41). As a
result of this collaboration, there are many gaps helping to reduce the ability of mitigating the
risks that were exposed previously. This helps in mitigating the gaps in between the
organizational communication as well as gaps in practice. Exposing these gaps, the organizations
will mainly have diversity for understanding, experiences, as well as opinions that helps to
strengthen quality of risk assessment. There are also other benefits for using the OCTAVE
Allegro methodologies that are listed below:
The OCTAVE Allegro methodologies includes qualitative considerations as well as
descriptions against the methodologies of risk assessment compared to the quantitative
ones.
The OCTAVE Allegro framework also brings the formal as well as systematic process
for analyzing the risks that are faced by the organizations.
The process of risk assessment mainly enables the organizations for implementing the
control where it is needed instead having controls that are opinion based. All such
processes is the most cost effective one because the measurement criteria of risk that will
be addressed with fewer expenses in the incidents that are to occur.
OCTAVE Allegro also allows the senior management for performing the due diligence as
well as understanding the accurate state of organization that is being informed about the
assessment strategy.
Helps the organization to shift the organizational culture in a risk based as well as in
qualitative culture.
6. Future Works and Conclusion
Approach of OCTAVE allegro mainly described in above stated report facilitates the
ability of the organization for understanding as well as managing the security risks that are
related to the information. This report provides a rapid as well as easy adoptable organizational
assessment as well as planning tool. The organizations that have used more than one methods of
OCTAVE in their business, the OCTAVE Allegro will evolve automatically.
In future, the brand of OCTAVE will actually represent some broad range of tools,
methodologies, as well as techniques that will define competencies including all the phases for

13RISK FRAMEWORK
continuous risk management of information security. This risk management will include risk
identification to risk assessment as well as risk analysis to risk mitigation. The OCTAVE Allegro
is positioned for helping all organizations to improve quickly all its capabilities of risk
assessment as well as will evolve in component that are skill based having a larger philosophy on
the information security process improvement and risk management.
The ways that helps to improve the approach of OCTAVE Allegro becomes more useful
to all organizations that can grow in the coming years. For instance, for helping and organization
evolving from security view to a view of operational resiliency, this methodology will expand
that will include consideration of all the information asset in associated business services context
and processes. For moving the OCTAVE from operational realm to some earlier phases asset as
well as life cycle of system development, OCTAVE Allegro will positioned as tool for using the
requirements of information security and development of information security.
The preliminary considerations that are to be taken care using the OCTAVE
methodologies are stated in the following section:
5.1 Evolving the Technique of Octave Allegro
5.1.1 To Focus on the Processes of Organization and the Services
The assets in an organization are actually charged in production supporting all the service
effecting the mission of the business. Most of the organizations represents more than 10 to 12
services that are fundamentally used to perform its business processes (Ramadhani et al.).
Evaluating the risks of the organization with the service delivery can help the organization for
ensuring the protection as well as sustainability strategies that is developed for optimizing risk
mitigation. It can also be stated that the process of mitigating the risk in an organization is related
directly to the information value and the assets related to information in the business processes as
well as services that supports the business.
For gaining the lasting value, process of risk assessment in an organization is performed
to make important connections between the strategic objectives as well as information
objectives, business continuity, IT operations, as well as System developments (Suroso and
Fakhrozi 202-213). To expand the focus of the OCTAVE Allegro needs to include all the
services as well as business processes of the organization that will help in providing context
which can change the operational practice aligned with the strategy of risk management in the
organization.
5.1.2 To expanding the View beyond the Operational Unit
The future work that is to be conducted on the OCTAVE Allegro might take in
consideration that the activities included in the information security are to be performed in
organization or in its unit volume operations. The information security, IT operations, business
continuity, system development as well as information security all are included to meet the
operational objective in an organization (Ali, Bako and Ali Awad 817). the main fundamental
principle associated with risk management is to ensure that all the above mentioned functional
areas in the organization operates on the same set risk drivers.
The OCTAVE Allegro methodology should be easy to adopt and use as there are
processes that are concentrated on all essential activities in the organization and are also focused

14RISK FRAMEWORK
on the operational unit level with the organization (Masky et al.). The result in the assessment
plan are actually designed with locally optimized organizational unit that performs the
assessment. The organization should be able to use output of assessment process for
understanding the risks as well as managing the risk on a wide scale.
The organization having OCTAVE Allegro methodology should also be able to handle all
the risks that can be idnetified at some operational unit level and helps in translating them to the
mitigation strategies that optimizes establishment of the baseline controls set of the organization
(Ganin et al.). When OCTAVE Allegro assessment is conducted by an operational unit, it helps
in determining all the identified risks that are addressed by baseline control. They also need to
implement all the additional control when they think that there might be risk associated with the
asset and the mission of the organization can outweigh all additional cost included in it.
5.1.3 Applying the OCTAVE Allegro in SDLC
OCTAVE Allegro is used traditionally in operation as well as maintaining the phases of
the System Development Life Cycle. The organization needs to approach the access as well as
develop the mitigation phase for all the assets as well as system deployed and are in operation.
Developing as well as implementing of risk mitigation plan for all the information asset or
resources that are in operation are extremely expensive (Silva and Jacob). The OCTAVE Allegro
should ensure that the system provides all such necessary control for protecting all assets the
organization stores, transports and processes. The methodology also should ensure that it will not
bolt the resources involved in the organization.
The system should also ensure to provide appropriate security control set for the
information asset that are contained requires security requirement captured as well as are
included in the stages of SDLC life cycle (Jufri et al.). Security requirements that are present in
the recent days are actually generated from the compliance and the considered as the best
practice in the business system.
The OCTAVE Allegro methodology is to be considered to be used in the earlier stage of
SDLC method for ensuring the security requirements that are associated with the organizational
goals as well as objectives and proper control are also developed and are implemented for the
critical assets.
In an assessment of OCTAVE Allegro, it is assumed to the information assets that are
conducted mostly supports the organization processes that helps in automating (Morris and
Nadine). This helps in capturing the requirement associated with security for the resources
supporting the business and helps to identify the gap in the structure of the system development.
5.2 Forward in Future
Introducing the OCTAVE Allegro methodology explained in this report is considered as
another step that incorporates all the lessons that are learned from all experiences for enhancing
the adoption as well as usability of the methods.
5.2.1 To Expand the Interest Community
The OCTAVE Allegro is generally accepted in the community of the information
security as the standard that conducts the risk assessments. As business and security continuity
mainly evolves in the resiliency and the organizations mostly looks forward to manage the

15RISK FRAMEWORK
operational risks, and also helps in growing the community interest. The community of the user
will also be tapped for providing the unique views on method availability that is in practice as
well as will have different ways that can tailor the extensibility in a big organization. To manage
the operational risk is the most important part in an organization and is considered as the part of
the overall portfolio of risk.
The activities that are planned in the future might include workshops or organized forum
which helps to draw the experience as well as expertise the community of the user. The expertise
collectively includes user community in the area of information security, the IT operations as
well as business continuity mainly provides some rich source that validates the work conducted.
5.2.2 To Explore the Connections in Framework of CERT Resiliency
The framework of CERT Resiliency is originally an emerging body and is a part of SEI.
CERT framework is foundation for all the process that improves the approach to the security as
well as continuity management of the business. It is actually a practice that helps in integrating
the security and activities of business continuity by defining all the important process of the
organization.
The OCTAVE Allegro is a framework that helps in integrating the business continuity as
well as security by defining the organization goals, specific practices, the organizational
processes that are necessary for the organization. It is expected that the operational and the
resiliency risk will be easy to manage in future with the help of OCTAVE Allegro.
5.2.3 To Update as well Improve Training
Course available on the information security involved in risk management is provided by
SEI and the OCTAVE Allegro method is expected to be improved and modified by the
developers. In future, training is expected to be given to the organization that states all the facts
related to the OCTAVE Allegro methodology. OCTAVE Allegro training is expected to have a
large focus on all the aspects related to information security of risk management education that
might include risk identification, risk analysis, as well as risk mitigation.

16RISK FRAMEWORK
References
Ali, Bako, and Ali Awad. "Cyber and physical security vulnerability assessment for IoT-based
smart homes." Sensors 18.3 (2018): 817.
Amini, Ahmad, and Norziana Jamil. "A Comprehensive Review of Existing Risk Assessment
Models in Cloud Computing." Journal of Physics: Conference Series. Vol. 1018. No. 1.
IOP Publishing, 2018.
Aminzade, Michael. "Confidentiality, integrity and availability–finding a balanced IT
framework." Network Security 2018.5 (2018): 9-11.
Díaz, Oswaldo, and Mirna Muñoz. "Reinforcing DevOps approach with security and Risk
Management: an experience of implementing it in a Data Center of a Mexican
Organization." 2017 6th International Conference on Software Process Improvement
(CIMPS). IEEE, 2017.
Ganin, Alexander A., et al. "Multicriteria decision framework for cybersecurity risk assessment
and management." Risk Analysis (2017).
Hariyanti, Eva, Arif Djunaidy, and Daniel Oranova Siahaan. "A Conceptual Model for
Information Security Risk Considering Business Process Perspective." 2018 4th
International Conference on Science and Technology (ICST). Vol. 1. IEEE, 2018.
Ilvonen, Ilona, and Jari Jussila. "Business orientation in knowledge security risk management–a
literature review." (2015).
Jufri, Muhammad Taher, Mokhamad Hendayun, and Toto Suharto. "Risk-assessment based
academic information System security policy using octave Allegro and ISO 27002." 2017
Second International Conference on Informatics and Computing (ICIC). IEEE, 2017.
Kawanishi, Yasuyuki, et al. "Detailed analysis of security evaluation of automotive systems
based on JASO TP15002." International Conference on Computer Safety, Reliability,
and Security. Springer, Cham, 2017.
Kelo, T., J. Eronen, and K. Rousku. "Enhanced Model for Efficient Development of Security-
Audit Criteria." Journal of Information Warfare 17.3 (2018): 50.
Ki-Aries, Duncan. "Assessing Security Risk and Requirements for Systems of Systems." 2018
IEEE 26th International Requirements Engineering Conference (RE). IEEE, 2018.
Kozlovs, Dmitrijs, Kristine Cjaputa, and Marite Kirikova. "Towards Continuous Information
Security Audit." REFSQ Workshops. 2016.
Masky, Mackita, Shin Soo Young, and Tae-Young Choe. "A Novel Risk Identification
Framework for Cloud Computing Security." 2015 2nd International Conference on
Information Science and Security (ICISS). IEEE, 2015.
Meszaros, Jan, and Alena Buchalcevova. "Introducing OSSF: A framework for online service
cybersecurity risk management." computers & security 65 (2017): 300-313.

17RISK FRAMEWORK
Morris, Alexis, and Nadine Lessio. "Deriving Privacy and Security Considerations for CORE:
An Indoor IoT Adaptive Context Environment." Proceedings of the 2nd International
Workshop on Multimedia Privacy and Security. ACM, 2018.
Pan, Liuxuan, and A. Tomlinson. "A systematic review of information security risk
assessment." International Journal of Safety and Security Engineering 6.2 (2016): 270-
281.
Ramadhani, Surya Tri Atmaja, Rudy Hartanto, and Eko Nugroho. "Risk-Management Based
Government Information System Security Using Octave Allegro
Framework." Proceeding of International Seminar & Conference on Learning
Organization. 2018.
Sardjono, Wahyu, and Muhamad Ilham Cholik. "Information Systems Risk Analysis Using
Octave Allegro Method Based at Deutsche Bank." 2018 International Conference on
Information Management and Technology (ICIMTech). IEEE, 2018.
Silva, F. R. L., and P. Jacob. "Mission-Centric Risk Assessment to Improve Cyber Situational
Awareness." Proceedings of the 13th International Conference on Availability,
Reliability and Security. ACM, 2018.
Suroso, Jarot S., and Bayu Rahadi. "Development of IT risk management framework using
COBIT 4.1, implementation in IT governance for support business
strategy." Proceedings of the 2017 International Conference on Education and
Multimedia Technology. ACM, 2017.
Suroso, Jarot S., and Muhammad A. Fakhrozi. "Assessment of Information System Risk
Management with Octave Allegro at Education Institution." Procedia Computer
Science 135 (2018): 202-213.
Tøndel, Inger Anne, et al. "Risk Centric Activities in Secure Software Development in Public
Organisations." International Journal of Secure Software Engineering (IJSSE) 8.4
(2017): 1-30.
Wahlgren, Gunnar, and Stewart James Kowalski. "IT Security Risk Management Model for
Handling IT-Related Security Incidents: The Need for a New Escalation
Approach." Security and Privacy Management, Techniques, and Protocols. IGI Global,
2018. 129-151.
Wangen, Gaute, Christoffer Hallstensen, and Einar Snekkenes. "A framework for estimating
information security risk assessment method completeness." International Journal of
Information Security (2017): 1-19.
Wangen, Gaute, Christoffer V. Hallstensen, and Einar Arthur Snekkenes. "A framework for
estimating information security risk assessment method completeness: Core Unified Risk
Framework." (2017).
Wangen, Gaute. "Information security risk assessment: A method comparison." Computer 50.4
(2017): 52-61.
Whitman, Michael. "Challenges in the Instruction of Risk Management." (2018).

18RISK FRAMEWORK
Yang, Tsung-Han, Cheng-Yuan Ku, and Man-Nung Liu. "An integrated system for information
security management with the unified framework." Journal of Risk Research 19.1 (2016):
21-41.