Quantitative Risk Analysis in Information Security Management: A Modern Fairy Tale
Rolf Oppliger · IEEE Security & Privacy · 2015
According to conventional wisdom, information security management must start with a quantitative risk analysis. Such an analysis works fine in theory, but it hardly works in practice. Baseline requirements, vulnerability management, and qualitative risk analysis can combine to provide a viable alternative.