Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've heard of FAIR, and that seems pretty great.

What other methodologies are there? How do they work?
What are their benefits, and their drawbacks compared to others?
When is each appropriate?

From another Area51 proposal.

share|improve this question
up vote 6 down vote accepted

The fundamental deference between the two methodologies is that GAIT is qualitative while FAIR is quantitative. Bottom line, GAIT is another one of those methods such as SAS70, SOX, Cobit and the rest that will end up to be a checklist exercise that will tell you nothing about your security or what the monetary value of your IT risk is.

share|improve this answer

I suggest reading Krag Brotby's Information Security Management Metrics book for coverage of most of the relevant risk analysis frameworks that are usually tailored to a specific kind of risk (e.g. financial analysis for information security management programs or risk management programs could use ROSI, ALE/SLE, VAR, cost-effectiveness, etc).

I also suggest looking at FISAP and IIA GAIT

share|improve this answer

+1 for GAIT. Definitely recommend a good look at it!

share|improve this answer
Have link? How does it compare to FAIR? – AviD Dec 20 '10 at 9:09

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.