SECURITY METRICS - RAVs (Risk Assessment Values)

Security metrics are the cornerstone of change control and information security management. Factual security numbers, measures based on security and loss control effectiveness as opposed to the number of implemented security and loss controls.

The OSSTMM refers to security metrics as RAVs or Risk Assessment Values. While not formulating risk assessments, the RAVs are the building block of any risk assessment. It is the facts for which you make your relative assumptions on. It is like the difference between knowing you need a large desk and knowing that you need one which 2.2m x 3m.

There is no fancy algorithm and there are absolutely no extraneous weights on the data. There are also no assumptions and no complex comparisons. It's a pure metric. The RAVs are designed to be simple, quickly calculated, accurate, and realistic. Furthermore, the RAVs are designed to be equally accurate whether calculating the security and loss controls measures for a military base, an office building, a bridge, a Mars rover, a computer network, or a single, interactive application on a computer.

RAVs are part of the OSSTMM and are protected under the Open Methodology License. Use of the RAVs is open to all both privately and commercially.
 

TOOLS & SOFTWARE	PRICE	DESCRIPTION
RAV Spreadsheet (.xls or .ods)	FREE	The standard calculation functions for Operational Security and Actual Security in a simple spreadsheet. Suggested for experts only.
RAV Formula	FREE	The standard calculation formula for Operational Security and Actual Security. Suggested for developers only.
Security Testing Audit Report (STAR)	FREE	The primary purpose of this Audit Report is to provide a standard reporting scheme based on a scientific methodology for the accurate characterization of security through examination and correlation in a consistent and reliable way. The secondary purpose is to provide guidelines which when followed will allow the auditor to provide a certified OSSTMM audit.

The best use of RAVs is for measuring security in a consistent and repeatable manner regardless of the company who provides testing. RAVs also allow for a percentage which is comparable through industry, organization size, region, policy, and financials. RAVs provide a benchmark that allows for third parties such as insurance companies, government auditors, industry regulators, and military personnel to correctly classify an organizational group from a single unit up to a national defense with one standard measurement.