R.A.R.E.: Round-About Risk Evaluation

摘要

With risk assessment such a crucial part of any IT operation, it is necessary to re-evaluate some of the methods used to procure genuine responses from those under assessment. Many current risk assessment methodologies are set up to fail from the beginning. When performing a risk assessment, the evaluator is dependent on the integrity of the IT team s/he is questioning as part of the assessment. A new methodology called the Round-About Risk Evaluation (R.A.R.E.), implements techniques to reduce the Social Desirability Bias (SDB) that can lead to an assessment that does not represent the depth of security vulnerabilities. Implementation of R.A.R.E. prior to the start of a new a risk assessment, can be used to help the risk assessment team discover vulnerabilities that might otherwise go unreported.