Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've heard of FAIR, and that seems pretty great.

What other methodologies are there? How do they work?
What are their benefits, and their drawbacks compared to others?
When is each appropriate?


From another Area51 proposal.

share|improve this question
add comment

3 Answers 3

up vote 6 down vote accepted

The fundamental deference between the two methodologies is that GAIT is qualitative while FAIR is quantitative. Bottom line, GAIT is another one of those methods such as SAS70, SOX, Cobit and the rest that will end up to be a checklist exercise that will tell you nothing about your security or what the monetary value of your IT risk is.

share|improve this answer
add comment

I suggest reading Krag Brotby's Information Security Management Metrics book for coverage of most of the relevant risk analysis frameworks that are usually tailored to a specific kind of risk (e.g. financial analysis for information security management programs or risk management programs could use ROSI, ALE/SLE, VAR, cost-effectiveness, etc).

I also suggest looking at FISAP and IIA GAIT

share|improve this answer
add comment

+1 for GAIT. Definitely recommend a good look at it!

share|improve this answer
    
Have link? How does it compare to FAIR? –  AviD Dec 20 '10 at 9:09
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.