Introducing OCTAVE Allegro: Improving the Information Security Risk Assessment Process
Abstract
First, the authors would like to thank Chris Alberts and Audrey Dorofee for their previous efforts in developing the OCTAVE method and OCTAVE-S.Without their hard work, there would be no basis from which to develop and transition the OCTAVE Allegro methodology.The authors would also like to thank members of the CERT ® Survivable Enterprise Management (SEM) team who have contributed to the evolution of OCTAVE since it was introduced.In particular, the authors would like to thank Bradford Willke and Sam Merrell for their review and the constructive feedback they provided on this document and the OCTAVE Allegro method
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
OCTAVE is a qualitative risk assessment framework that proposes eight steps.
“OCTAVE (Operationally Critical Threat, Asset, and Vulnerability Evaluation) is another qualitative risk assessment framework that proposes eight steps [32].”
From IoT cyber risk: A holistic analysis of cyber risk assessment frameworks, risk vectors, and risk ranking process (2020) · cites this paper as [32]
Cites
Managing Information Security Risks: The OCTAVE Approach
Alberts, C., & Dorofee, A. (2002) · CERN Document Server (European Organization for Nuclear Research) · Cited by 352 · see citing works
The Critical Success Factor Method: Establishing a Foundation for Enterprise Security Management
Caralli, R. A. (2004) · KiltHub Repository · doi:10.1184/r1/6585107 · Cited by 148 · see citing works
Self-citationOCTAVE-S Implementation Guide, Version 1
Albert, C., Dorofee, A., Stevens, J. F., et al. (2005) · KiltHub Repository · doi:10.1184/r1/6575852 · Cited by 28 · see citing works
Self-citationStevens, J. F., Caralli, R. A., & Willke, B. J. (2005) · doi:10.21236/ada441305 · Cited by 16 · see citing works
Self-citationCaralli, R. A., Stevens, J. F., Wallen, C., et al. (2007) · Figshare · doi:10.1184/r1/6574805 · Cited by 11 · see citing works
Self-citation
Flagged first, then by citations
Cited by
Sorted by citations
Cyber and Physical Security Vulnerability Assessment for IoT-Based Smart Homes
Ali, B., & Awad, A. (2018) · Sensors · doi:10.3390/s18030817 · Cited by 344 · see citing works
Future developments in cyber risk assessment for the internet of things
Radanliev, P., De Roure, D. C., Nicolescu, R., Huth, M., Montalvo, R. M., Cannady, S., & Burnap, P. (2018) · Computers in Industry · doi:10.1016/j.compind.2018.08.002 · Cited by 162 · see citing works
Kandasamy, K., Srinivas, S., Achuthan, K., & Rangan, V. P. (2020) · EURASIP Journal on Information Security · doi:10.1186/s13635-020-00111-0 · Cited by 160 · see citing works
Wangen, G., Hallstensen, C., & Snekkenes, E. (2018) · International Journal of Information Security · doi:10.1007/s10207-017-0382-0 · Cited by 109 · see citing works
Cyber Risk Management for the Internet of Things
Radanliev, P., Charles De Roure, D., R.C. Nurse, J., Burnap, P., Anthi, E., Uchenna, A., Maddox, L., Santos, O., & Mantilla Montalvo, R. (2019) · doi:10.20944/preprints201904.0133.v1 · Cited by 17 · see citing works
Cybersecurity Threats, Vulnerability and Analysis in Safety Critical Industrial Control System (ICS)
Lou, X., & Tellabi, A. (2020) · Studies in Systems, Decision and Control · doi:10.1007/978-3-030-31328-9_4 · Cited by 13 · see citing works
IIoT-ARAS: IIoT/ICS Automated Risk Assessment System for Prediction and Prevention
Zahran, B., Hussaini, A., & Ali-Gombe, A. (2021) · Proceedings of the Eleventh ACM Conference on Data and Application Security and Privacy · doi:10.1145/3422337.3450320 · Cited by 10 · see citing works
- Authors
- Caralli, R. A., Stevens, J. F., Young, L. R., & Wilson, W. R.
- ORCID
- Wilson, William R.
- Publisher
- Defense Technical Information Center
- Published
- 2007-05-01
- OpenAlex
- W4234540472
- Cited by
- 294
- References
- 5
- Citations by year
- 2026: 9 · 2025: 8 · 2024: 25 · 2023: 23 · 2022: 30 · 2021: 36 · 2020: 36 · 2019: 24 · 2018: 37 · 2017: 18 · 2016: 15 · 2015: 8 · 2014: 5 · 2013: 5 · 2012: 2
- Type
- report
- Language
- en
- Open access
- closed
- Funders
- U.S. Department of Defense
- Carnegie Mellon University
- Australian Government
- Topics
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Physical Sciences › Computer Science › Information Systems › Web Application Security Vulnerabilities
- Social Sciences › Business, Management and Accounting › Management Information Systems › Information Technology Governance and Strategy
- Keywords
- OCTAVE Allegro, information security risk assessment, OCTAVE-S, security risk management, CERT, risk assessment methodology
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
