From: fergus (fergus@cobbled.net)
Date: Fri Apr 23 2004 - 18:02:31 EDT
On 23.04-09:57, Amit Deshmukh wrote:
[ ... ]
> ... would anyone know of
> a simple risk assessment methodology that could be
> employed for small to medium businesses?
the problem is not the methodology it is the
understanding. you need to understand the threat
and risk on a number of levels to make an
effective assessment.
that is what you pay for at the end of the day;
experience and knowledge.
for a simple example, it would be difficult to implement
a password policy if you do not understand the
relevant issues; that comes down to users,
distribution, environment, etc, etc. all these
things are logical and if you have the necessary
understanding then you do not need methodology -
not for small businesses.
it's basically an issue of common sense (once you
can ably cover the issues).
if you mean a vulnerability assessment or pen-test
then you are better (for the small business
sector) to simply use tools. nessus basically; it
will be adequate for the target.
the problem is that small companies have low value
assets and most have very little relating to
information/computers. even the ones that should
know better (i.e. accountants and solicitors) are
ill able to afford and digest a detailed report.
they simply need a solution that puts them a
couple of levels higher than the next guy.
to summarise - perceived risk is low and therefore
over investment in detailing actual risk is
difficult, costly and unpopular.
-- : fergus cameron : [ .] cobbled : : ^^^^^^@cobbled.net : [ ~][ ] .net : ------------------------------------------------------------------------------ Ethical Hacking at the InfoSec Institute. Mention this ad and get $545 off any course! All of our class sizes are guaranteed to be 10 students or less to facilitate one-on-one interaction with one of our expert instructors. Attend a course taught by an expert instructor with years of in-the-field pen testing experience in our state of the art hacking lab. Master the skills of an Ethical Hacker to better assess the security of your organization. Visit us at: http://www.infosecinstitute.com/courses/ethical_hacking_training.html -------------------------------------------------------------------------------
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:53:52 EDT