Comments on: On Value and Loss

By: Perilocity

Perilocity — Fri, 27 Apr 2007 13:51:57 +0000

Ignore What’s Hard to Measure?

But IT security generally doesn’t have the economic part worked out.
With quantification of value and probable loss we’d have better risk management.

By: PlanetHeidi

PlanetHeidi — Thu, 19 Apr 2007 14:47:41 +0000

Been following the draft work for ISO 27004? It’s all about setting an international standard for infosec measurements. Essentially, layering on top of 27001 system for managing controls (controls being in 17799). Lotsa tough math in there… but I see that as a good thing.

By: Alex

Alex — Wed, 18 Apr 2007 23:38:48 +0000

Your criticism is FAIR enough (sorry, couldn’t resist). I actually have not offered an alternative.

I believe the alternative lies in processes, not assets.

But measuring the value of a process, unless you’ve got some hot shot consulting company (*cough*) is problematic.

Hopefully someone will figure it all out and distribute the answer using some open or semi-open license.