Risk management

Traditional approaches to threat and risk analysis tend to focus heavily on scrutiny of the infrastructure, paying limited attention to:

organisational and business objectives
where the system sits in the organisation
the processes that the infrastructure is there to facilitate
the environment in which the system operates
human factors such as the risk of ‘insider’ and ‘social engineering’ attacks.

These approaches can lead to an over-investment in IT technology at the expense of other areas such as process design and operator training. Yet statistics show that the greatest risk to organisations' IT systems and data come from staff within the organisation.

Castelain's approach combines a number of techniques to overcome these concerns. Our approach is based on the National Institute of Standards and Technology's (NIST's) Risk Management Guide for Information Technology Systems, supplemented in areas by techniques such as an applied use of the Clarke Wilson Integrity Model to assess human factors such as the risk of insider attacks.