Failed attempt at optimizing InfoSec Risk Assessment

Last weekend I got into a discussion with an insurance supervisor on the topics of risk assessment. He explained the process of work of actuaries in insurance, and that there are standardized tables of probabilities for an event to occur, like sickness and death, and how it is used to calculate insurance premiums.

After digesting the explanation, my reaction was that I found the holy grail of the Information Security Risk analysis: All it takes is for enough amount of incident event be collected into a statistical table, and all possible types of information security incidents will have a standardized table of frequency and impact - no more assessments over the entire organization!

And in such a great and utopian solution, at least a quarter of the time the information security personnel will fell like they are doing actuarial jobs.

But I was quickly brought back to reality by the expert in insurance, with a good question: Actuarial tables are compiled based on information that is mandatory to be published - illness, fires, theft, even death. How will you collect accurate information from information security, when it's not mandatory to publish them?

And he was perfectly correct: Collecting information to compile an actuarial table for information security will be impossible. There are very few companies in the world that will release any information that there was an information security incident if it hasn't impacted the public in a very obvious way. Also, the value of the impact is calculated in any number of methods, and different items are included in the value, making the valuation of the incident an incomparable attribute from one incident to another.

Having a standardized method for risk assessment in information security based on hard numbers would be great. But since the factors included in any incident are very complex and varying, and also consistent incident reporting is nearly impossible, we will be sticking to the current qualitative methods.


Talkback and comments are most welocme

Related posts

Example Risk Assessment of Exchange 2007 with MS TAM
Risk Assessment with Microsoft Threat Assessment & Modeling  

33 comments:

Security Consultants said...

Great information provided by you on the subject of risk assessment. According to my opinion security risk, analysis, otherwise known as risk assessment, are fundamental to the security of any organization. It is essential in ensuring that controls and expenditure are fully commensurate with the risks to which the organization is exposed.
business security

Vanzari vile said...

Keep sharing like this!

Cauciucuri iarna said...

You have a great blog and good articles.

Credite bancare said...

Thanks for sharing it!!

Hosting gratuit said...

Congrats for the article

yuvikhan said...

good choice to copy/clone total telephone info. useful source These had been the strategies you can work with to xender download app nice.

thilak said...

thank you...
voot for pc

voot apk

yeecall for pc

dirlinigritton said...

good or maybe flat-out imaginative. They’re all, to set it bluntly, celebrity snapchat selena gomez snapchat username golf clubs you want you had been suspending out at rather than nice.

Srinivasan T said...

Very nice article thanks for it

Licensed Moneylender
Digibrand Group

robertgreene said...

good there will be some requirements required. open You can likewise download the films of your preference and you may enjoy it afterwards. iTube Download PC nice.

Anonymous said...

lenovo SHAREit for PC is the best solution to transfer data from one to another device. Shareit for PC

francisstephen said...

Unbelievably individual pleasant website. Great details available on couple of clicks on.
SSLC Result

Kerala SSLC Result

Karnataka SSLC Result

Tamilnadu SSLC Result

meganscott said...

good and water use by nearly 40%. By designing the valves fleck 5600 water softener in the water at your residence. Permit us verify out nice.

CBSE RESULT said...

Nice and informative
CBSE Result

CBSE 10th Class Result

CBSE 12th Class Result

francisstephen said...

SSLC Result 2017
keralaresults.nic.in
karresults.nic.in
tnresults.nic.in
pue.kar.nic.in

Sujit Kumar said...

Thanks for the great share mate.
ubud bali accommodation
muscat hotels

Getit said...

Lovely blog it is. Download Zapya for PC to share files and folders easily from PC to Mobile

bigphotographers said...

awesome Also though the programmers are presently functioning on to bring you tv player well as video clip having fun applications of this period nice.

cbse results2017 said...

check your results cbse 10th results and cbse 12th results.

HannahAMueller said...

good Search for the apple iphone account name, http://vsharedownloadpro.com so we will certainly be alerted to fix your troubles asap. best.

Sunmugam Chidambaram said...

Awesome blog
Download xender for pc
Very good for share FILES ,PICTURES PC To any Android

cathrynzbrown said...

good Also, there are replicated versions of Snapchat snapchatonlineloginn.com And also within simply a blink of an eye, you get nice.

Anonymous said...

Students can check sslc result 2017 from here.kseeb board will release the karnataka sslc result 2017 soon.The board will soon publish the kerala sslc result soon.

Anonymous said...

Get PSEB 10th Result here

Anonymous said...

Get 2nd puc result 2017 here

Anonymous said...

How to get odisha chse result at official website?

John Peter said...

I enjoyed over read your blog post. Your blog have nice information, I got good ideas from this amazing blog. I am always searching like this type blog post. I hope I will see again..
Best Toilet Brands

Anonymous said...

Get PSEB 10th Result here

Anonymous said...

Visit our blog to about Kitchen appliances to make your life easier.

Sofiya G said...

I wanted to thank you for this great read!! I definitely enjoying every little bit of it I have you bookmarked to check out new stuff you post.

Do you want to know who is winner for bumper prize click here for more details Holi bumper 2017 - http://www.holibumper.com/
Here you can check all results and win bumper prize click here punjab state lottery - http://punjab-lotteries.com/
All daily results will be publishing you can win the best result lottery result today - http://lotteries.ind.in/

Sofiya G said...

I found your this post while searching for some related information on blog search...Its a good post..keep posting and update the information.

You can get all weekly lottery result published by kerala lottery result - http://keralalotteryresult-co.in
You can’t wait for your lottery results just one click here for lottery sambad - http://www.lottery-sambad.com
Amazing results here it can change your life click on this for more details west bengal state lottery - http://westbengalstatelotteries.com/

Sofiya G said...

Everyone dreams to live best so go through this and make your dream come true sikkim state lottery - http://sikkim-lotteries.com/
This is one of the best lottery result ever click on this nagaland state lottery - http://nagaland-lotteries.com/
Great prizes are waiting for you here can you guess winner of the day click here mizoram state lottery - http://mizoram-lotteries.com/

Anonymous said...

Get PSEB 10th Result here

Designed by Posicionamiento Web