Operationally Critical Threat, Asset, and Vulnerability Evaluation(SM) (OCTAVE[SM]) Framework, Version 1.0

The Networked Systems Survivability (NSS) Program of the Software Engineering Institute (SEI) has begun developing the Operationally Critical Threat, Asset, and Vulnerability Evaluation^SM (OCTAVE^SM)¹ framework to describe an information security risk evaluation. OCTAVE defines a set of self-directed activities for organizations to identify and manage their information security risks. Evaluations that are consistent with the OCTAVE framework will be comprehensive and will allow an organization to identify the information assets that are important to its mission, the threats to those assets, and the vulnerabilities that may expose those information assets to the threats. By putting together the information assets, threats, and vulnerabilities, the organization can begin to understand what information is at risk. Once it has a picture of the risks, the organization can design a protection strategy to reduce the overall risk exposure of its information assets.

This document describes the essential components of OCTAVE, focusing on what each process step accomplishes. Issues such as who will perform the steps or how to perform them will be addressed in subsequent publications. By issuing this report, we intend to initiate a discussion of what elements make up a comprehensive information security risk assessment that examines both organizational and technology issues. Over time, as we develop and pilot an evaluation method consistent with the OCTAVE framework, we anticipate that the details described in this report will be modified. When appropriate, we will revise this document and the method to reflect changes based on comments from the community as well as on our field experience.

The current version of OCTAVE comes primarily from the following three sources:

• Information Security Evaluation (ISE). The ISE is an information security vulnerability evaluation developed by the Software Engineering Institute’s Networked Systems Survivability Program. It focuses on identifying vulnerabilities in an organization’s computing infrastructure. It addresses assets and threats implicitly. OCTAVE developers are incorporating the lessons learned from the development and delivery of the ISE into the OCTAVE framework and method.
• Software risk management expertise. OCTAVE is also incorporating many of the diagnostic techniques and theories developed by the SEI’s Risk Program, which focused on identifying risks to software development projects. Many of the principles for OCTAVE’s Phase 1 are derived from work that focused on risk management issues facing managers in a software development organization.
• Surveying the current state of the practice in information security risk management. Articles about state-of-the-practice information security assessments were examined prior to the development of OCTAVE. This information was used to determine what is working in the community and where the community could benefit from a self-directed comprehensive information security risk assessment.

Information systems are essential to most organizations today. The integrity, availability, and confidentiality of information are critical to organizations’ missions. However, few organizations focus on their most important information assets when they make decisions about protecting their information. For example, a bank might consider its customers’ bank records to be one of its important information assets. Likewise, a military organization responsible for deploying troops might consider logistical data to be an important information asset. Most organizations form their protection strategies by focusing solely on infrastructure weaknesses. Those organizations fail to establish the effect of the infrastructure weaknesses on information assets, such as bank records or logistical data.

This leads to a gap between the organization’s operational requirements and information technology (IT) requirements. Often, the computing infrastructure is set up without the IT staff having a clear understanding of the organization’s mission- or business-related needs. It is not clear if important information is being adequately protected. Likewise, significant effort might be directed toward protecting relatively unimportant information. In these situations, the operational or business units of the organization and the information technology department are not communicating effectively.

Often, information protection decisions are made in an ad hoc manner, based on the IT department’s prior experience with vulnerabilities and the threats that they currently know about. Thus, risks tend not to be systematically managed or are managed by the wrong people.

Most current approaches to information-security risk management tend to be incomplete, expert-driven, or both. Most approaches fail to include all the components of information security risk (assets, threats, and vulnerabilities). In these cases, the organization has insufficient data to fully match a protection strategy to its security risks.

Many organizations outsource information security risk assessments because they do not have in-house capability to perform this vital service. They hire experts to perform risk assessments, and the resulting assessment is only as good as the experts who perform it. Often the consumers of such services have no way to understand if the risk assessment performed for them is adequate for their enterprise.

OCTAVE enables organizations to avoid those problems. It defines the essential components of a systematic information-security risk assessment. By following the OCTAVE framework, an organization can make information-protection decisions based on risks to the confidentiality, integrity, and availability of critical information assets. The operational or business units and the departments responsible for the information infrastructure work together to address the information security needs of the enterprise. OCTAVE thus gives the organization a comprehensive, systematic, context-driven approach to managing information-security risks.  

Phase 3, Determine Security Risk Management Strategy  

During Phase 1, information assets and their values, threats to those assets, and security requirements are identified using knowledge of the staff from multiple levels within the organization, along with standard catalogs of information. For example, known threat profiles and good organizational and technical practices are used to probe staff members for their knowledge of the organization’s assets, threats, and current protection strategies. This information can then be used to establish the security requirements of the enterprise, which is the goal of the first phase of OCTAVE.