IT Risk Assessment Methodologies

This week’s topics

IT Risk Assessment Methodologies

1. Quantitative versus qualitative risk analysis
2. Threat modeling techniques
3. Asset identification and vulnerability scanning
4. Evaluating frameworks like NIST SP 800-30 and OCTAVE
5. Understand Vulnerability Management Maturity with a Self-Assessment Tool

What you will be able to do

• 4.1 Evaluate various risk assessment procedures.

Activity

Start with this week’s video, then: Seminar, guided reading and a short written task: evaluate various risk assessment procedures.

Study materials

Videos

• Understand Vulnerability Management Maturity with a Self-Assessment Tool · YouTube · SANS Institute · 58 min · for registered students
• The Secret to Vulnerability Management · YouTube · SANS Institute · 58 min · for registered students
• Vulnerability Scanning - CompTIA Security+ SY0-701 - 4.3 · YouTube · Professor Messer · 8 min · for registered students

Further resources

• NIST SP 800-30 Rev. 1: Guide for Conducting Risk Assessments · PDF · NIST, guidance; 95 pages · for registered students
• NIST SP 800-115, section 4: Target Identification and Analysis Techniques · PDF · NIST, textbook chapter; pp. 4-1–4-11 · for registered students
• NCSC: Vulnerability scanning tools and services · PDF · NCSC, guidance; 7 pages · for registered students