If you have any responsibilities related to Information Security, you should own and use this book.

OCTAVE (Operationally Critical Threat, Asset and Vulnerability Evaluation^SM) is a risk-based strategic assessment and planning technique for security, for organizations who want to get a full picture of their information security needs.

Typically, IT security managers employ a technology-focused approach. Their assessments are targeted at technological risk and focused on tactical issues relating to the information systems technology. That's not enough.

Security has to relate to business strategy and business practices, what assets are important to critical business operations, and what the security risks are for those assets.

The key results of OCTAVE include a protection strategy for organizational improvement and mitigation plans to reduce the risks to your organization's critical assets.

See our OCTAVE page for more information and links about OCTAVE.

From the book jacket:

Information security requires far more than the latest tool or technology. Organizations must understand exactly what they are trying to protect--and why--before selecting specific solutions. Security issues are complex and often are rooted in organizational and business concerns. A careful evaluation of security needs and risks in this broader context must precede any security implementation to insure that all the relevant, underlying problems are first uncovered.

The OCTAVE approach for self-directed security evaluations was developed at the influential CERT(R) Coordination Center. This approach is designed to help you:

• Identify and rank key information assets
• Weigh threats to those assets
• Analyze vulnerabilities involving both technology and practices

OCTAVE enables any organization to develop security priorities based on the organization's particular business concerns. The approach provides a coherent framework for aligning security actions with overall objectives.

Managing Information Security Risks, written by the developers of OCTAVE, is the complete and authoritative guide to its principles and implementations. The book:

• Provides a systematic way to evaluate and manage information security risks
• Illustrates the implementation of self-directed evaluations
• Shows how to tailor evaluation methods to different types of organizations

Special features of the book include:

• A running example to illustrate important concepts and techniques
• A convenient set of evaluation worksheets
• A catalog of best practices to which organizations can compare their own