Octave
- 1. OCTAVE
- 2. About Me ▶ AMAR MYANA Senior Software Developer Security Brigade Infosec Pvt. Ltd. 3 ½ years
- 3. Summary ▶ Operationally Critical Threat, Asset, and Vulnerability Evaluation (OCTAVE) ▶ an approach for managing information security risks ▶ Key Differences Between OCTAVE and Other Approaches ▶ Key Characteristics of the OCTAVE Approach ▶ OCTAVE Phases ▶ Two OCTAVE-consistent methods developed at the Software Engineering Institute (SEI) ▶ the OCTAVE Method for large organizations ▶ The OCTAVE-S for small organizations ▶ Choosing Between the Methods
- 4. What Is OCTAVE? ▶ OCTAVE is a risk based strategic assessment and planning technique for security. ▶ OCTAVE is self-directed ▶ OCTAVE is targeted at organizational risk and focused on strategic, practice-related issues. ▶ When applying OCTAVE, a small team of people from the operational (or business) units and the information technology (IT) department work together to address the security needs of the organization, balancing the three key aspects ▶ Operational Risk ▶ Security Practices, ▶ and Technology
- 5. What Is OCTAVE? ▶ OCTAVE approach is driven by two aspects: ▶ Operational Risk ▶ Security Practices ▶ By using the OCTAVE approach, an organization makes information-protection decisions based on risks to the confidentiality, integrity, and availability of critical information-related assets.
- 6. Key Differences Between OCTAVE and Other Approaches OCTAVE Other Evaluations Organization evaluation System evaluation Focus on security practices Focus on technology Strategic issues Tactical issues Self direction Expert led
- 7. Key Characteristics of the OCTAVE Approach ▶ OCTAVE is an asset-driven evaluation approach. Analysis teams ▶ identify information-related assets (e.g., information and systems) that are important to the organization ▶ focus risk analysis activities on those assets judged to be most critical to the organization ▶ consider the relationships among critical assets, the threats to those assets, and vulnerabilities (both organizational and technological) that can expose assets to threats ▶ evaluate risks in an operational context - how they are used to conduct an organization’s business and how those assets are at risk due to security threats ▶ create a practice-based protection strategy for organizational improvement as well as risk mitigation plans to reduce the risk to the organization’s critical assets
- 8. OCTAVE Phases ▶ Phase 1: Build Asset-Based Threat Profiles ▶ This is an organizational evaluation. ▶ It identifies threats to each critical asset, creating a threat profile for that asset ▶ Phase 2: Identify Infrastructure Vulnerabilities ▶ This is an evaluation of the information infrastructure. ▶ Examines network access paths, identifying classes of information technology components related to each critical asset. ▶ Phase 3: Develop Security Strategy and Plans ▶ Identifies risks to the organization’s critical assets and decides what to do about them
- 10. OCTAVE Method ▶ The OCTAVE Method was developed with large organizations in mind (e.g., 300 employees or more). ▶ OCTAVE Method Processes ▶ Phase 1: Build Asset-Based Threat Profiles ▶ Process 1: Identify Senior Management Knowledge ▶ Process 2: Identify Operational Area Knowledge ▶ Process 3: Identify Staff Knowledge ▶ Process 4: Create Threat Profiles ▶ Phase 2: Identify Infrastructure Vulnerabilities ▶ Process 5: Identify Key Components ▶ Process 6: Evaluate Selected Components ▶ Phase 3: Develop Security Strategy and Plans ▶ Process 7: Conduct Risk Analysis ▶ Process 8: Develop Protection Strategy
- 11. OCTAVE-S ▶ OCTAVE-S was developed and tested for small organizations, ranging from 20 to 80 people. ▶ OCTAVE-S relates to the Phase 2 evaluation of the computing infrastructure. ▶ OCTAVE-S also includes an optional, qualitative version of probability. ▶ OCTAVE-S Processes ▶ OCTAVE-S has the same three phases described in the OCTAVE approach and in the OCTAVE Method. ▶ Phase 1: Build Asset-Based Threat Profiles ▶ Process S1: Identify Organizational Information ▶ Process S2: Create Threat Profiles ▶ Phase 2: Identify Infrastructure Vulnerabilities ▶ Process S3: Examine the Computing Infrastructure in Relation to Critical Assets ▶ Phase 3: Develop Security Strategy and Plans ▶ Process S4: Identify and Analyze Risks ▶ Process S5: Develop Protection Strategy and Mitigation Plans
- 12. Choosing Between the Methods ▶ The OCTAVE Method is structured for an analysis team with some understanding of IT and security issues, employing an open, brainstorming approach for gathering and analyzing information. ▶ OCTAVE-S is more structured. Security concepts are embedded in OCTAVE-S worksheets, allowing for their use by less experienced practitioners. ▶ The following set of questions should be used to help you decide which method is best suited for your organization. Question OCTAVE Method OCTAVE-S Size and complexity of the organization Is your organization small? Does your organization have a flat or simple hierarchical structure? • Are you a large company (300 or more employees)? Do you have a complex structure or geographically- dispersed divisions? •
- 13. Choosing Between the Methods Question OCTAVE Method OCTAVE-S Structured or Open-Ended Method Do you prefer a more structured method using fill-in-the-blanks, checklists, and redlines, but not as easy to tailor? • Do you prefer a more open-ended methodology that is easy to tailor and adapt to your own preferences? • Analysis team composition Can you find a group of three to five people for the analysis team who have a broad and deep understanding of the company and also possess most of the following skills? • Can you find a group of 3-5 people for the analysis team who have some understanding of at least part of the company and also possess most of the following skills? •
- 14. Choosing Between the Methods Question OCTAVE Method OCTAVE-S IT resources Do you outsource all or most of your information technology functions? • Do you have a relatively simple information technology infrastructure that is well understood by at least one individual in your organization? • Do you manage your own computing infrastructure and are familiar with running vulnerability evaluation tools? • Do you have a complex computing infrastructure that is well understood by one or more individuals in your organization? • Are you able to run, comprehend, and interpret the results of vulnerability evaluation tools within the context of information- related assets? •
- 15. Choosing Between the Methods Question OCTAVE Method OCTAVE-S Using a Beta-version method Are you willing to use a beta-version of a method (that is, use a method that may not have all the guidance you might need)? •