Title: Quantitative versus Qualitative Risk Control Practices
Course: IN 2001 Principle of Information Assurance > Section: Module 4: Chapter Four

Quantitative versus Qualitative Risk Control Practices
1. Many steps described in this chapter were performed using actual values or estimates.  This is known as a quantitative assessment.
2. An organization could determine that it cannot put specific numbers on these values.
3. Fortunately, it is possible to repeat these steps using an evaluation process, called qualitative assessment, which is based on characteristics that do not use numerical measures.

Benchmarking and Best Practices
1. Instead of determining the financial value of information and then implementing security as an acceptable percentage of that value, an organization could take a different approach and look to peer institutions for benchmarks.
2. Benchmarking is the process of seeking out and studying the practices used in other organizations that produce the results you desire in your organization.
3. When benchmarking, an organization typically uses one of two measures to compare practices: metrics-based measures or process-based measures.
4. Metrics-based measures are comparisons based on numerical standards, such as:
  - Number of successful attacks
  - Staff hours spent on systems protection
  - Dollars spent on protection
  - Number of security personnel
  - Estimated value in dollars of the information lost in successful attacks
  - Loss in productivity hours associated with successful attacks
5. An organization uses this information to rank competitive businesses with a similar size or market to determine how it measures up to competitors.  The difference between an organization’s measures and those of others is often referred to as a performance gap.
6. Process-based measures are generally less focused on numbers and more strategic than metrics-based measures. For each of the areas the organization is interested in benchmarking, process-based measures enable the organization to examine the activities an individual company performs in pursuit of its goal, rather than the specifics of how goals are attained.  The primary focus is the method the organization uses to accomplish a particular process, rather than the outcome.
7. In information security, two categories of benchmarks are used: standards of due care and due diligence and best practices.
8. When organizations adopt levels of security for a legal defense, they may need to show that they have done what any prudent organization would do in similar circumstances.  This is referred to as a standard of due care.
9. Organizations cannot implement these standards and then ignore them.  The application of controls at or above the prescribed levels and the maintenance of those standards of due care show that the organization has performed due diligence.
10. Due diligence is the demonstration that the organization is diligent in ensuring that the implemented standards continue to provide the required level of protection.
11. Failure to support a standard of due care or due diligence can open an organization to legal liability, provided it can be shown that the organization was negligent in its application or lack of application of information protection.
12. Organizations should remember the adage, “Good security now is better than perfect security never.”
13. Security efforts that seek to provide a superior level of performance in the protection of information are referred to as best business practices or simply best practices or recommended practices.
14. Best security practices (BSPs) are those security efforts that are among the best in the industry, balancing the need to access with the need to provide adequate protection.  Best practices seek to provide as much security as possible for information and systems while maintaining a solid degree of fiscal responsibility.
15. Within best practices, the gold standard is a subcategory of practices that are typically viewed as “the best of the best.”
16. Applying Best Practices
  - When considering to adopt best practices in your organization, consider the following:
    - Does your organization resemble the identified target organization with the best practice under consideration?
    - Are the resources your organization can expend similar to those identified with the best practice?
    - Is your organization in a similar threat environment as that proposed in the best practice?
17. Problems with the Application of Benchmarking and Best Practices
  - The biggest problem with benchmarking in information security is that organizations don’t talk to each other.
  - Another problem with benchmarking is that no two organizations are identical.
  - A third problem is that best practices are a moving target. What worked well two years ago may be completely worthless against today’s threats.
  - One last issue to consider is that simply knowing what was going on a few years ago, as in benchmarking, doesn’t necessarily tell us what to do next.
18. Baselining
  - A baseline is a “value or profile of a performance metric against which changes in the performance metric can be usefully compared.”
  - Baselining is the analysis of measures against established standards. In information security, baselining is the comparison of security activities and events against the organization’s future performance.  When baselining, it is useful to have a guide to the overall process.

Other Feasibility Studies
1. Other qualitative approaches that can be used to determine an organization’s readiness for any proposed set of controls are operational, technical, and political feasibility analyses.
2. Organizational Feasibility
  - Organizational feasibility examines how well the proposed information security alternatives will contribute to the efficiency, effectiveness and overall operation of an organization.
  - Above and beyond the impact on the bottom line, the organization must determine how the proposed alternatives contribute to the business objectives of the organization.
3. Operational Feasibility
  - Operational feasibility analysis examines user acceptance and support, management acceptance and support and the overall requirements of the organizations’ stakeholders. Operational feasibility is sometimes known as behavioral feasibility, because it measures the behavior of users.
  - One of the fundamental principles of systems development is obtaining user buy-in on a project. A common method for obtaining user acceptance and support is through user involvement.  User involvement can be obtained via three simple steps: communicate, educate and involve.
  - Organizations should communicate with system users throughout the development of the security program, letting them know that changes are coming.  Organizations should make efforts to design training to educate employees about how to work under the new constraints and avoid any negative impact on performance.  Those making changes must also involve users by asking them what they want from the new systems and what they will tolerate from the new systems and by including selected representatives from the various constituencies in the development process.
  - These three basic undertakings—communication, education and involvement—can reduce resistance to change and build resilience for change. Resilience is that ethereal quality that allows workers not only to tolerate constant change, but also to accept it as a necessary part of their jobs.
4. Technical Feasibility
  - In addition to the economic costs and benefits of proposed controls, the project team must also consider the technical feasibilities of their design, implementation and management.
  - Technical feasibility analysis examines whether or not the organization has or can acquire the technology necessary to implement and support the proposed control.
  - Technical feasibility also examines whether the organization has the technological expertise to manage the new technology.
5. Political Feasibility
  - For some organizations, the most significant feasibility evaluated may be political.  Within organizations, political feasibility defines what can and cannot occur based on the consensus and relationships between the communities of interest.
  - The limits placed on an organization’s actions or behaviors by the information security controls must fit within the realm of the possible before they can be effectively implemented and that realm includes the availability of staff resources.