OCTAVE Allegro

The OCTAVE Allegro approach being introduced in this technical report is designed to allow broad assessment of an organizations operational risk environment with the goal of producing more robust results without the need for extensive risk assessment knowledge. This approach differs from previous OCTAVE approaches by focusing primarily on information assets in the context of how they are used, where they are stored, transported, and processed, and how they are exposed to threats, vulnerabilities, and disruptions as a result. However, OCTAVE Allegro is also well suited for use by individuals who want to perform risk assessment without extensive organizational involvement, expertise, or input.

OCTAVE Allegro Roadmap The OCTAVE Allegro approach consists of eight steps that are organized into four phases. In phase 1, the organization develops risk measurement criteria consistent with organizational drivers. In phase 2, information assets that are determined to be critical are profiled. This profiling process establishes clear boundaries for the asset, identifies its security requirements, and identifies all of the locations where the asset is stored, transported, or processed. In phase 3, threats to the information asset are identified in the context of the locations where the asset is stored, transported, or processed. In phase 4, risks to information assets are identified and analyzed and the development of mitigation approaches is commenced.

Threats consist of the following properties: Asset Actor Motive Access Outcome

During OCTAVE, the following standard categories of threat are considered: Human actors using network access Human actors using physical access System problems Other problems The resulting outcome or effect of these threat scenarios typically falls into these categories: Disclosure or viewing of sensitive information Modification of important or sensitive information Destruction or loss of important information, hardware, or software Interruption of access to important information, software, applications, or services Threat actors: Non-malicious employees Disgruntled employees Attackers Spies Terrorists Competitors Criminals Vandals

OCTAVE ALLEGRO WORKSHEETS One of the keys to successfully using the OCTAVE Allegro methodology is in understanding and working with the worksheets that support the process. The worksheets have been designed so that they would be easily translatable to other electronic formats, and individuals and organizations using the Allegro methodology are encouraged to do so. Risk Measurement Criteria and Impact Area Prioritization Worksheets The OCTAVE Allegro methodology, risk measurement criteria against which an organization can evaluate a risks effect on its mission and a business objective is created. To facilitate this activity, five standardized worksheets are provided that allow an organization to identify high, medium, and low impacts in the following categories: Reputation/customer confidence (Worksheet 1) Financial (Worksheet 2) Productivity (Worksheet 3) Safety and health (Worksheet 4) Fines/legal penalties (Worksheet 5) In addition to these five worksheets, an additional worksheet is provided solely for userdefined impact areas (Worksheet 6) The impact area prioritization worksheet is used in computing the relative risk score. (Worksheet 7) Information Asset Profile Worksheet An information asset profile is a representation of an information asset describing its unique features, qualities, characteristics, and value. The Information Asset Profile worksheet captures all of this information. (Worksheet 8) Information Asset Risk Environment Maps The Information Asset Risk Environment Maps capture all of the places where an information asset is stored, transported, or processed. There are three map worksheets, one for each of the different container types defined by the OCTAVE Allegro method: Technical (Worksheet 9a) Physical (Worksheet 9b) People (Worksheet 9c)

Information Asset Risk Worksheets The creation of the Information Asset Risk Worksheet is a key feature of the Allegro process. On this worksheet both the threat and impacts associated with a risk are captured, the relative risk score is computed, and mitigation plans and activities are captured. (Worksheet 10)