1. Sanjay Goel, School of Business/Center for Information Forensics and Assurance University at Albany Proprietary Information 1 Unit Outline Qualitative Risk Analysis Module 1: Qualitative Risk Analysis Module 2: Determine Assets and Vulnerabilities Module 3: Determine Threats and Controls Module 4: Matrix Based Approach Module 5: Case Study  Module 6: Summary

2. Sanjay Goel, School of Business/Center for Information Forensics and Assurance University at Albany Proprietary Information 2 Summary Qualitative Risk Analysis Qualitative risk analysis involves using relative values of assets, threats, vulnerabilities to: – Determine the relative exposure of different assets of the organization – Determine the relative effectiveness of different controls The methodology developed here uses a series of matrices to collect the data on assets, vulnerabilities, threats and controls Data from the matrices is integrated to determine the relative importance of controls This approach is suitable when precise data for different elements is unavailable Most organizations start with a qualitative analysis and gradually migrate to a quantitative analysis

3. Sanjay Goel, School of Business/Center for Information Forensics and Assurance University at Albany Proprietary Information 3 Suggested Reading Qualitative Risk Analysis Backhouse, J. and Dhillon, G. (1996). Structures of responsibility and security of information systems. European Journal of Information Systems, 5(1), 2-9. Baskerville, R. (1993). An Analytical Survey of Information System Security Design Methods: Implications for Information Systems Development. ACM Computing Surveys, 375-414. Parker, D.B. (1981). Managers Guide to Computer Security. Prentice-Hall, Inc, Reston, VA, USA.

4. Sanjay Goel, School of Business/Center for Information Forensics and Assurance University at Albany Proprietary Information 4 Acknowledgements Grants and Personnel Support for this work has been provided through grants from the following agencies –National Science Foundation (NSF 0210379) –Department of Education (FIPSE) Damira Pon, from the Center of Information Forensics and Assurance contributed extensively by reviewing and editing the material Robert Bangert-Drowns from the School of Education reviewed the material from a pedagogical view. Melissa Dark & Ting Zhuang from Purdue University provided a critique of the material and facilitated creation of a distance delivery version of the course.