Using Vulnerability Assessment Tools To Develop an OCTAVE Risk Profile

Threats to information technology are ever increasing and many organizations are spending much money and time in attempting to fix security problems. Before one can think about remediation, assets worth protecting and knowing what to protect those assets from must be defined. OCTAVE characterizes a self-directed methodology for defining an organization's assets and the assets' risks. Critical to OCTAVE are the tools and processes toward developing asset based threat profiles. The threat profile includes network risks, also known as vulnerabilities that often times analysis team members are not qualified to assess. Vulnerability assessment tools aid the OCTAVE analysis team to determine exactly what network-aware technological risks face any certain asset and often times help to further define the asset itself. By applying the results of a vulnerability assessment to an OCTAVE Risk Profile, many unanswered questions pertaining to the asset and its risks are fulfilled in an autonomous and consistent fashion.