1

I had this couple of threads in here which talks about security assessment v/s risk assessments, but here the idea is completely different. Suppose, I had to breakdown qualitative tasks from the quantative ones, I would end up breaking these.

I came up with this model and was wondering if I am on the right path to understand them more better. Here's my model:

  1. I break up the 'security' into two - quantitative analysis and qualitative analysis
  2. I again break them into specific tasks which I found via the WWW

So in particular, the first segment i.e: 'security assessment' fits more to the quantitative tasks and 'security engagements' fill up more towards qualitative task. This is how I look at it now:

  1. Security Assessment

    • Risk Assessment
    • Threat Assessment
    • Security Compliances
  2. Security Engagement

    • Code Review
    • Vulnerability Assessments
    • Penetration Testing
    • Red Team Enagagements

The first pointer has all the assessments and compliances compiled up and the second one is more of defensive + offensive approaches taken to 'quality' test the risks accessed in the first pointer. The defensive ones are code review and vulnerability assessments since the organization is taking up the engagement from teh defensive viewpoint and the latter two are offensive since it's challenging an auditor to find loopholes, break-through and actually exploit.

My question at this point is all of this concept is true or I have been missing on something since there are lot of more terms!?

1 Answer 1

0

There are plenty of risk assessment methodologies. You first question should be "why building yet another one"?

The ones which exist are either generic (COBIT-based, NIST SP 800-30, Mehari, ...) or specific to an area (the EU Critical Infrastructure Protection for instance). By using an established methodology you build credit in what you will deliver.

1
  • I do realize there are specified and industry recongnized ones, but then this is just not about only risk assessment but all the assessments which are taken into one account and all the rest of the engagements which are considered into another account. Jul 1, 2015 at 18:01

Not the answer you're looking for? Browse other questions tagged .