DTIC ADA430828: OCTAVE(Federal Registration)-S Implementation Guide, Version 1.0, Volume 7: Critical Asset Worksheets for Applications

2.5 MB·English

by  Defense Technical Information Center

fe a0 13

HANDBOOK
CHUISEL2008-H8-008

Carnegie Mellon

Software Engineering Institute

OCTAVE®-S Implementation
Guide, Version 1.0

Volume 7: Critical
Asset Worksheets for
Applications

‘Christopher Alben
Cael Wondty

envary 2005
Carnegie Mellon
Software Engineering Institute .
Prcunh, PAISERGEH

OCTAVE®-S Implementation
Guide, Version 1.0

Volume 7: Critical Asset
Worksheets for Applications

GraLSEL-2000-HE-008

Christophe Akers
Autrey Doralee
demas Stevens
‘earel Woody

stanuary 2008

Networked Syetems Survivabllty Progcem

nite eaten ae ep

20050322 129
This pon ws prepared forthe

1 okt Prom Oe:
ESCIRPK

5 gin Suost
‘anacom AMD, 8 0:751-2100

“The ideas sd findings this eport chav othe cons as anit DoD pasitn. i pulses i ee
fhnesea of ene ad tka nfmationexchang,

FOR (HE COMMANDER

Cites Scondras
(Cato Progr, XP

“Thi wi ie spenaorel bythe U.S. Departs of Defense The Soar Fnghcering Isis i.
‘ele handed research ed development cere sponsored hy the U.S. Depatnen of Dens,

conpigt 208 Cae Mallon Dery,

0 OCtAYESsseitee in he US. Paes & Tatemark Oa by Cagle Mallon Gasecy

5M perl Con The, Astana Valeriy Een a esis mk Camas Men sins

NOWARRANTY

“TAS CARNEOIE M1 ON UNIVERSITY AND SOITWARE ENGIKHERING LNSTIFL.TE MATERLA18
TURNISHED ON AN "AB 18" BASIS, CARNEGIE MELLON UNIVERSIJY MAKES NO WARRNTICS
‘GPANY EIND, EITHER EXPRESSED OR IMPLIED, AS TO SNY MATTER INCILUDING. BUT NOT
CIATED TO, HARKANTY OF FI'KESS FOR PURPOSE OR MERCFIANTABILAT¥. PACLUSIVETY, OR
RESTS TS OBTAINED HROM USE OF 1B MATERIAL. CARNEGIE MI-L1ON UNIVLRSIY DOES
NOT MARE ANY WARRANTY OF ANY KIND WITH RESPECT TO FREEDOM FROM PATI),
TRADEMARK, OR COPYRIGHT INFRINGEMENT.

‘Coro an vara in his post inet ay wy leg on tis othe demir Ker

Jr ne Peis modo hi du and pe orks os sno ere ne >
‘Pie ride) om eoysin and "Mo War" eterna luded wil epodution abv wks

‘ternal ute Regen fr prison ove fi evento ropa deste ws of hs een for eta
rest emmecol se shouldbe er the SEILEESING AL

“This work wat rome in the gecemare of Fla Gevernmen Cuctst ober ¥39626- 204-015 wt: Cae
‘Matos Catrifor te eaten he Stace Earn ou, a feel funde ee nd evap me
‘Mier tne Gover ent ofthe Usd Sexes ate ove ct pra ee epee, oon he
Sint ori porn ay many tw US a7 pr ls Go er oe pe che
Cee hen der he clase 225227 33.

Fr itaaton bo pncasng pane erie SEL ers east er oiction porn Web st
(thine. ce. eeason aoe tun
OcTAN!

Ss VL0 ‘Fable of Coments

Table of Contents

‘About This Document

Abotract..

1 {nteodtuction

2. Grileal Asset Information Worksheet for Applications,

3. Risk Profile Worksheet for Anplicetions - Human Actors Using Network Access ..9

4 Blsk Profile Worksheot for Appl

tions - Human Actors Using Physical Access.1a

& Risk Profile Workhest for Applications — Systom Problems.

6 Alek Profile Workeheat for Applications — Other Problems.

7 Network Access Paths Worksheet,

8 Threat Translation Guld

Grave 2008 16-008 Vourne 7 i
Table of Comeats OCTAVESS VLD

iSO AAT sin?
OCTAVES

Listof Tees

List of Tables

Table 1: Worksheets Provided in This Workbook

‘DANUBE 2005-H8-008 Volume 7
Lise af Tables OCTAVES VIO

SMUISEL 2008 HB.008 volume 7
OCIAVES VL About Tais Donen

About This Document

“This document is Value 6 ofthe OCTAVE:S Implementation Gide, a 10evolune handbook
sxipporting the OCTAVE-S wncchadatogy. This volume provides warkshetsto docament
data slated to orca ussets lar ate categorized us appicaions,

volumes inthis handbook are

+ Voture F;frvduction 19 OCTAVE.S ~ Tals volume provides basic descrigvion nf

OCTAVE aud advice on how tu use the guide

+ Vottate 2: Prepavation Gidetines ~ This volume contains background and guidance for
preparing t> comet an OCTAVE'S evstution

Vote 3: Method Guidelines ~ This volume includes detailed guidance fr each,
OCTAVES aunty

4+ Vonwne 4: OrgunizatinatIxlormosion Workbook - This volume provides worksheets for
al organivatonal-tevel infection gathered wnd amalyatd dosing OCTAVE.

> Volunte $: Critica! Asset Workbook fo Fnfrmation ~ This volume jravides srorkshexts
a document dua elated fo cite! arses thal are calegocand a information,

> Volume 6: Critical Asset Worktoo for Systems ~ This volume provides werkaheets to
cue da relate oeitcal assets that ue categorized as systems,

4 Volume 7: Critical Asset Workbook for Applications ~ This volume provides
warkhecs tw document dita related to critical assets that ae extegurized as applications.

“+ Valuane 8: Critical Asses Workbook for People ~ This volume provides srorkshexts (0
locum da cated to critical asset ha age estagorized ws people

‘+ Volume 9; Siraregy and Plan Workbuok—This volume provides worksheets to round die
‘unten and desire protection Mrategy and the risk ection plans.

+ Volume 10; Bsconple Scenario - This volume inludesa deteled scenario illustrating a
completed set of worksheets
Abpat This Document OCTAVE VLO

a "REN AGS Value?
OCTAVES V1.0 Abstcact

Abstract

‘The Operaionally Critical Thvex, Asset, and Vulnerability Fvslntion™ (OCTAVE)
‘appeoach afin i rsk-baned sirategie assessment nd planning technique for secur:
OCTAVE is a alt-diocted uppeoach, mesning tht peupe rom an organization asic
esponsibility fr soting the organiztion’s security seategy. OCTAVE:S
appevac tilored tthe limited means and unique constraints lypealy fowne in small
‘oxgtnizitions less than 100 people). OCTAVE: isle hy a sal, iatediseptinary team
{hres t five people) of an organization's personnel svn galler sind aaly2e information,
‘pradaving # profecrion srategy un mitigation plas based onthe organization's unique
‘operation geri risks. Toy enucl OCTAVE'S effectively, he lea ust have broad
knwledge of the organization's business end security processes. 50 it wl be ale to conduct
ll aii By iso

is» satiation of the

‘CHISEL E02 12-008 Vana? i