Additionally, as budgets for security controls are limited, one would have to prioritize risks to mitigate the most important threats first and leave less endangered assets for later. Assurance companies can provide extremely valuable data that can be used as input in these risk assessments. Unfortunately they only have data for a limited amount of threats. To make IT security management more objective and reduce the guessing, we need more hard numbers that we can use in quantitative risk assessment. This is not the assurance company?s problem on the short term, it?s ours.

PS: Great article, you hit the nail on the head!

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/435/34363#34363