My first recommendation for what you're looking for would be SOMAP. Their website claims open source, but I'm not sure it meets your needs entirely.
This question is similar to this other question, but I'll let you decide if anything is of value there.
In the government domain, the National Standards Institute of Technology (NIST) has special publication 800-37, which was originally taken from the FITSAF standard on risk assessments, so it's worth mention.
The book, "Information Security Management Handbook, Sixth Edition", explains that security risk assessments are usually based on a value chain model. Another book, How to Complete a Risk Assessment in 5 Days Or Less, covers the author's FRAAP process. There are a few books coming out very soon that look to answer your question best. One is from Syngress Press and by author Evan Wheeler. Another, by Douglas Landoll, is in its second edition. A recent book from Andrew A. Vladimirov came out, but I have not yet read it.