Managing information security risks: the OCTAVE approach

Information security requires far more than the latest tool or technology. Organizations must understand exactly what they are trying to protect - and why - before selecting specific solutions. Security issues are complex and often are rooted in organizational and business concerns. A careful evaluation of security needs and risks in this broader context must precede any security implementation to insure that all the relevant, underlying problems are first uncovered.