Information Security Forum Report Highlights Quantitative Techniques in Information Risk Analysis

NEW YORK - Oct. 18, 2018 - PRLog -- The Information Security Forum (ISF), the trusted source that senior security professionals and board members turn to for strategic and practical guidance on information security and risk management, today announced the release of Using Quantitative Techniques in Information Risk Analysis. Their latest report helps organizations to extract value from uncertainty by accurately estimating and calculating their information risk. While qualitative techniques are still encouraged by the ISF for many organizations, the possibilities presented in Using Quantitative Techniques in Information Risk Analysis provide an alternative method which delivers value through the application of rigorous and testable techniques that enable organizations to accurately measure their exposure to loss. The report explains three techniques – estimating, calibrating and reviewing – that are essential for understanding and undertaking quantitative information risk analysis.

"To direct investment and manage exposure to loss, organizations need to embrace the unknown – learning how to measure and reduce their uncertainty," said Steve Durbin, Managing Director of the Information Security Forum. "Quantitative techniques provide an arsenal of tools that account for uncertainty, with the potential for accurate measurement of information risk to direct meaningful decision making. These techniques have been tested through trial and error in numerous industries – insurance, healthcare, oil and finance –and can be used with the promise of accumulative value over time."

Risk is inherently uncertain, however, many approaches to information risk analysis conceal uncertainty through inconsistent terminology and inaccurate models, leaving organizations unaware of their true risk posture and resigned to directing investment with scant evidence. Due to cultural precedent and/or regulatory demand, some organizations may be required to use qualitative terminology to categorize loss bandings and/or prioritize risks. To report quantitative losses qualitatively, organizations may use familiar labels, such as low, medium or high, or traffic light scoring, including green, amber or red, to describe the bandings of loss.

Using Quantitative Techniques in Information Risk Analysis is informed by ISF research into leading organizations' efforts to use quantitative techniques in information risk analysis. The report enables organizations to gain value by:

·         Providing techniques that are essential for understanding and undertaking quantitative information risk analysis

·         Demonstrating how quantitative information risk analysis can be conducted to provide accurate and informative results

·         Presenting ways in which the results of quantitative information risk analysis can be communicated to support decision making

To ensure information risk analysis delivers value, organizations should adopt the ISF Approach for Using Quantitative Techniques in Information Risk Analysis. The ISF Approach sets out a scenario-led analysis, which calculates information risk to provide accurate results and demonstrates how modelling information risk can communicate results to support decision making, directing effective mitigation and return on investment for organizations. Scenario-led analysis helps organizations to adopt a defined vocabulary and quantified metrics that exploit a robust, mathematical calculation. This approach provides accurate results that direct effective mitigation and Return on Investment (ROI) for the organization.

"As maturity grows, organizations should seek a new direction, building models that improve probabilistic outcomes, retain knowledge and reduce error. With repetition, organizations can develop a model which scales and preserves expert opinion," continued Durbin. "Using a model that can be measured enables organizations to identify where improvement is required and where value is being delivered."

Using Quantitative Techniques in Information Risk Analysis is available now via the ISF website (http://www.securityforum.org/).

About the Information Security Forum

Founded in 1989, the Information Security Forum (ISF) is an independent, not-for-profit association of leading organizations from around the world. The organization is dedicated to investigating, clarifying and resolving key issues in cyber, information security and risk management and developing best practice methodologies, processes and solutions that meet the business needs of its Members.

ISF Members benefit from harnessing and sharing in-depth knowledge and practical experience drawn from within their organizations and developed through an extensive research and work program. The ISF provides a confidential forum and framework, which ensures that Members adopt leading-edge information security strategies and solutions. By working together, ISF Members avoid the major expenditure required to reach the same goals on their own. Consultancy services are available and provide ISF Members with the opportunity to purchase short-term, professional support activities to supplement the implementation of ISF products.

For more information on ISF membership, please visit https://www.securityforum.org/.