Hey,
> Jeg vil derfor blive glad, hvis der er nogen som kan hjælpe mig med
> inspiration og materiale. Gerne kopi af jeres nødplan/beredskabsplan.
Der findes en metode til at lave en risikovurdering som hedder OCTAVE.
http://www.cert.org/octave/
By following the OCTAVE method, an organization can make
information-protection decisions based on risks to the availability of
critical information technology..
The OCTAVE Method, available now, was built with large organizations in
mind. A second method, OCTAVE-SSM, will focus on small organizations.
Using a three-phase approach, OCTAVE examines organizational and technology
issues to assemble a comprehensive picture of the information security needs
of an enterprise. The phases of OCTAVE are:
Phase 1: Build asset-based threat profiles - This is an organizational
evaluation. Key areas of expertise within the organization are examined to
identify important information assets, threats & security requirements of
the assets, what the organization is currently doing to protect its
information assets (protection strategy practices), and weaknesses in
organizational policies and practice (organizational vulnerabilities).
Phase 2: Identify infrastructure vulnerabilities - This is an evaluation of
the information infrastructure. The key operational components of the
information technology infrastructure are examined for weaknesses
(technology vulnerabilities) that can lead to unauthorized break.
Phase 3: Developing security strategy and plans - Risks are analyzed after
information from the organizational and information infrastructure
evaluations (Phases 1 and 2) are analyzed to identify risks and to evaluate
the impact on the enterprise and its mission. In addition a protection
strategy for the organization addressing the highest priority risks is
developed.
Jeg ved at Teledanmark benytter metoden, eller dele af den.
_D_