OCTAVE Allegro Risk Framework: A Comprehensive Guide

Running head: RISK FRAMEWORK
Risk Framework
Name of Student-
Name of University-
Author’s Note-

1RISK FRAMEWORK
Table of Contents
1. Introduction..................................................................................................................................3
1.1 OCTAVE Risk Framework...................................................................................................3
1.2 History of OCTAVE Framework..........................................................................................4
1.3 Introduction to OCTAVE ALLEGRO...................................................................................4
2. Evolving the OCTAVE Method..................................................................................................5
2.1 Experience Using OCTAVE Method....................................................................................5
2.2 Need of OCTAVE Allegro Method.......................................................................................5
2.3 Requirements for using OCTAVE Allegro...........................................................................6
3. Roadmap of OCTAVE Allegro...................................................................................................6
4. Using the OCTAVE Allegro Risk Framework..........................................................................10
4.1 Preparing the Octave Allegro..............................................................................................10
4.1.1 Obtain Sponsorship of the Senior Management...........................................................10
4.1.2 To Allocate Organizational Resources.........................................................................11
4.1.3 Requirements for Training............................................................................................11
4.2 Performing the Assessment.................................................................................................11
4.2.1 To Select Information Assets........................................................................................12
4.2.2 To Develop the Criteria of the Risk Measurement.......................................................12
4.2.3 To Repeat the Assessment............................................................................................12
5. Benefits of Risk Assessment with OCTAVE Allegro...............................................................13
6. Future Works and Conclusion...................................................................................................13
5.1 Evolving the Technique of Octave Allegro.........................................................................14
5.1.1 To Focus on the Organizational Processes and the Services........................................14
5.1.2 Expanding View beyond the Operational Unit.............................................................14
5.1.3 Applying the OCTAVE Allegro in SDLC....................................................................15
5.2 Looking Forward in Future..................................................................................................15
5.2.1 Expanding Interest Community....................................................................................15
5.2.2 Exploring Connections in CERT Resiliency Framework.............................................16
5.2.3 Updating as well Improving Training...........................................................................16
References......................................................................................................................................17

2RISK FRAMEWORK
1. Introduction
Management of risk and mitigation of risk is basically a process that is used to identify,
access as well as mitigate the scope of the risks, the schedule, quality, and the cost of the risk in a
project. There are many opportunities as well as threats from where the risk comes from and the
risks are scored on their occurrence probability as well as impact of the project (Wangen,
Christoffer and Einar). The planning that is done for mitigating the risk is basically a process that
develops the options as well as actions for enhancing the opportunities as well as reducing the
threats related to project objectives. Implementation of the risk mitigation is considered as a
process that executes the action to be taken for risk mitigation. The monitoring of risk mitigation
involves the risks tracked are identified, along with identifying many new risks as well as
evaluating the effectiveness of risk process all through the project.
For having a better management of risk as well as mitigation roadmaps, many of the
organizations have very high information security frameworks that would help to seize the
opportunities as well as achieve the strategic goals of the organization (Kawanishi et al.). One
framework that can be involved for getting high information security is Operationally Critical
Threat, Asset and Vulnerability Evaluation (OCTAVE). This approach is mainly built by the SEI
(Software Engineering Institute) for addressing all compliance challenges of information security
that are faced by the organizations.
The methodologies involved in OCTAVE are mainly created for tackling the challenges
of information security that are faced by (DoD) Department of Defense in U.S. The
methodologies of OCTAVE have various number of effectiveness and presently this particular
methodology is used by the public as well. The objective of the OCTAVE approach is helping
the organizations for ensuring the goals as well as objectives that are connected with activities of
information security.
1.1 OCTAVE Risk Framework
The methodology of risk assessment of OCTAVE approach is identifying the security
risks, managing them, as well as evaluating the information of the security risks. The OCTAVE
methodology mainly serves an organization in the following ways:
 Helps in developing the criteria of risk evaluation that helps in describing the operational
risk tolerance of the organization.
 Helps in identifying all assets needed for accomplishing the mission of the organization.
 Identifying the vulnerabilities as well as threats for all the assets.
 Determining as well as evaluating the consequences that are faced by the organizations if
there is threat in the organization.
 Initiating the continuous improvement of the actions for mitigating the risks.
The methodology of OCTAVE approach helps in directing the individuals responsible for
management of the operational risk of the organization (Wahlgren and Stewart 129-151). This
might include the business personnel of the organization of the business units, the person that are
involved in the information security or the conformity in the organization, the risk managers, and
the department of information technology as well as participation of the staff in activities of the
risk assessment with helps of the OCTAVE approach.
1.2 History of OCTAVE Framework

3RISK FRAMEWORK
For resolving the continuous issues related to the risk management, the SEI has
developed the first ever OCTAVE approach framework in the year 1999. This particular
framework included large corporations having 300 employees or more. The framework was then
having hierarchy of multi-layer as well as the framework is also responsible for managing the
software infrastructure in the organization (Ilvonen and Jari 270-281). The main evaluation
criteria that helps to use the framework are mainly based on an approach that is three phased.
The three phase approach includes technological view, Risk Analysis, and Organizational View.
In the year 2003, updating the original framework was developed and was then named as
the OCTAVE-S risk assessment framework. This particular approach was developed for the
small organizations having less than 100 employees having hierarchy that is flexible and can also
have team members that are specialized (Pan and Tomlinson 270-281). The approach containing
three phase is basically used in the approach of OCTAVE and is intended for the small teams in
the organization that can deal this approach.
Finally in the year 2007, the CERT team (Computer Emergency Response Team) is a
particular program conducted by SEI has updated the version of OCTAVE-S and named it as
OCTAVE Allegro. This approach is developed for the organizations that mainly focuses on the
information assets of how the framework will be used by the organization and how the
information is stored, processed as well as transported in the organization (Aries). The
organization also focuses on how their information assets are exposed to the threats, disruptions,
and vulnerabilities. The allegro version of the OCTAVE framework helps in reducing many
requirements as well as processes that helps in making the framework easy to use. The Allegro
approach helps in shifting the OCTAVE approach from asset centric technology to a risk
assessment that is based on the information.
1.3 Introduction to OCTAVE ALLEGRO
OCTAVE Allegro is basically considered as a methodology for restructuring as well as
optimizing the process of measurement included in the security risk for achieving the required
goal having small investment in the specified time, specified people, and include other resource
as well (Suroso and Rahadi). With the help of OCTAVE Allegro methodology, the organizations
helps in considering the people, facilities as well as technology in regards with the information,
services as well as business processes that are supported by the framework.
The OCTAVE Allegro mainly defines all critical components included in a framework of
risk assessment of the information security. This is mainly done by referring the risk with
availability, integrity as well as confidentiality of the assets. With this approach, the organization
will not have any problem to define the critical assets which can occur risk or the risk that are not
mentioned in the methodologies of the organizations (Wangen). The OCTAVE Allegro mainly
provides clear instruction about the way of identifying the critical assets in same time connected
with the organizational goals as well as objectives related to security goals as well as objectives.
The security teams included framework will mainly work together with operational teams for
addressing the needs of information security for protecting the critical data. The IT departments
of the organization will not take the critical decisions.
The organizations that includes the OCTAVE Allegro approach mainly requires the
profiles of information assets for having better as well as unambiguous definition for the asset
boundaries (Whitman). The profile helps to enable the organization in defining the security