| The need for proper securitization and protection of computer systems and their peripherals from internal and external threats had created a social dilemma for many organization that were concerned with the minimization of risk exposure to their computer systems and facilities. This document portrays meaningful considerations for evaluating and selecting risk assessment software for managing risks in computer and telecommunications systems. As a consequence of the variety of risk management products accessible in the risk community, there was no consistent procedure of ascertaining which of the risk management products were most appropriate for any given organization's condition. A new method was proposed by William M. Garrabrantss, Alfred W. Ellis III, Lance J. Hoffman, and Magdi Kamel that competently and impartially evaluated these risk management products for appropriateness and instituted a criteria for selecting the most effective and efficient product. In addition to this new method, another method was also developed by Irene E. Gilbert Guide to Selecting Automated Risk Analysis Tools.; The information presented in this document was obtained from reviews of risk analysis software models in the Risk Management Research Laboratory that was jointly supported by the National Institute of Standards and Technology (NIST) and the National Computer Security Center (NCSC) and from numerous published articles, journals, books, Federal government and Agency files, and academic authors.; This document contains several questionnaires and a product selection checklist developed by Garrabrantss, Ellis, Hoffman, Kamel, and Gilbert for evaluating and comparing risk management methodologies and tools. Six risk assessment procedures were performed by the researcher and expert security risk analysts using the following risk management tools: CRAMM, RiskWatch, RA/SYS, BUDDY System, BDSS, and LAVA on a computer facility. These questionnaires, referred to as the "Evaluation Metrics" by Garrabrantss, Ellis, Hoffman, and Kamel were sent to vendor references, EDP security and systems analysts to be completed. Upon completion of the questionnaires, they were sent back to the researcher for analysis and evaluation. Based on this process the best methodology became apparent. |
