ALEs; this is when they really come in handy. The countermeasure will cost some money, but look at the risk metrics!

Here is a very important aspect of pitching risk management to the organization's management: Don't nickel and dime. The bigger picture you can paint of all the risks, vulnerabilities, countermeasures, and get-well plans, the more receptive they are likely to be.

How Risky Is a Risk?

I really like to hear host-based intrusion-detection sales folks give presentations. It has always been an uphill battle, and in these days of personal firewalls where anyone that wants host protection can get it for $40 to $60, it is becoming comical! The sales people get going on the insider threat and play that issue like a harp with one string. They have to do this; they are fighting a perception problem, or perhaps it would be better to state this as an education problem. What they are trying to do is get the potential customer to rate one risk higher than another. If you think about it, this is a common sales tactic.

In Virginia, they don't get much snow, but at the beginning of winter, the auto ads are really pushing four-wheel drive vehicles. Never mind the fact that they cost more, are more mechanically complex, and get fewer miles per gallon than two wheel drives; if you buy one, you don't have to be afraid of the snow. We can learn two things from this: to consider as many risks as possible and to keep things in perspective. We want to be able to rank risk. There are two basic approaches to ranking risk: the quantitative and qualitative approach.

Quantitative Risk Assessment

The goal of this approach is to figure out what the risk is numerically. The most common way to do this is asset valuation using our friends the SLEs and ALEs. This is not worth doing for each desktop system in your organization! It can be a very effective tool at the organization level, however, and the numbers are not that hard to dig up. To calculate asset value (AV), use this formula:

AV = Hardware + Commercial software + Locally developed software + Data

Your comptroller should be able to produce your organization's hardware and software budget and actuals in a matter of minutes. The value of locally developed software is usually a bit trickier. You have to take the burdened cost of everyone paid to develop software for your organization for some number of years. Data is where it gets interesting! Isn't it true that almost everyone in your organization uses a computer? If so, the value of the data is what your organization has paid to keep those people in front of computers for whatever is a reasonable life cycle for the data. (I usually use three years.) This is going to be a big number! It shouldn't take longer than an hour to hammer out a reasonable value for your organization's information assets. This can be a really good thing to have available if you need to persuade management to fund something, or to quit doing something really risky.

Qualitative Risk Assessments