Security Risk Management Guide v1.2 Readme
March 15, 2006
© 2006 Microsoft Corporation. All rights reserved.

Contents

1. Download and On-line Locations for the Security Risk Management Guide
2. Brief description of the Security Risk Management Guide
3. Getting started
4. Folder contents
5. Copyright and license agreement

Download and On-line Locations for the Security Risk Management Guide

- Download Center: http://go.microsoft.com/fwlink/?linkid=32050
- TechNet online: http://go.microsoft.com/fwlink/?linkid=30794

Brief Description of the Security Risk Management Guide

This prescriptive guide helps customers of all types plan, build, and maintain a successful security risk management program. In a four phase process, the guide explains how to build an ongoing process to measure and drive security risks to an acceptable level.

This guide is technology agnostic and references many industry accepted standards for managing security risk. It is an important example of Microsoft's commitment to delivering quality guidance to help customers secure their Information Technology (IT) infrastructures. This guide incorporates real-world experiences from Microsoft IT and also includes input from Microsoft customers and partners.

This download contains the guide as listed below, plus several sample Tools and Templates that accompany the guide in the Security Risk Management Guide Tools and Templates.msi.

Important: These samples are provided as EXAMPLES ONLY. Be sure to review, customize, and test the provided tools before using them in any non-test environment.

Getting Started

To begin using the solution, read Chapter 1, "Introduction to the Security Risk Management Guide", of the Security Risk Management Guide.

Folder Contents

The following section lists the contents of the Security_Risk_Management_Guide_v1.2.zip download.

Readme.htm

This Readme file

Release Notes.htm

The release notes for the Security Risk Management Guide.

The Security Risk Management Guide.doc

Chapter 1: Introduction to the Security Risk Management Guide

Chapter 1 introduces the Security Risk Management Guide (SRMG) and provides a brief overview of subsequent chapters. It also provides information about the following:

- Keys to succeeding with a security risk management program
- Key terms and definitions
- Style conventions in the papers
- References for further information

Chapter 2: Survey of Security Risk Management Practices

Chapter 2 lays a foundation and provides context for the SRMG by reviewing other approaches to security risk management and related considerations, including how to determine your organization's risk management maturity level.

Chapter 3: Security Risk Management Overview

Chapter 3 provides a more detailed look at the four phases of the SRMG process while introducing some of its important concepts and keys to success. The chapter also offers advice on preparing for the program by planning effectively and placing strong emphasis on building a solid Security Risk Management Team that has well defined roles and responsibilities.

Chapter 4: Assessing Risk

Chapter 4 addresses the first phase, Assessing Risk, in detail. Steps in this phase include planning, data gathering, and risk prioritization. Risk prioritization itself is comprised of summary and detailed levels, balancing qualitative and quantitative approaches in order to provide reliable risk information within reasonable trade-offs of time and effort. The output from the Assessing Risk phase is a list of significant risks with detailed analysis that the team can use to make business decisions during the next phase of the process.

Chapter 5: Conducting Decision Support

Chapter 5 addresses the second phase, Conducting Decision Support. During this phase, teams determine how to address the key risks in the most effective and cost efficient manners. Teams identify controls; estimate costs; assess the degree of risk reduction; and then determine which controls to implement. The output of the Conducting Decision Support phase is a clear and actionable plan to control or accept each of the top risks identified in the Assessing Risk phase.

Chapter 6: Implementing Controls and Measuring Program Effectiveness

Chapter 6 addresses the final two phases of the SRMG: Implementing Controls and Measuring Program Effectiveness. During the Implementing Controls phase, the Mitigation Owners create and execute plans based on the list of control solutions that emerged during the decision support process.

When the first three phases of the security risk management process are complete, organizations should estimate their progress with regard to security risk management as a whole. The final phase, Measuring Program Effectiveness, introduces the concept of a "Security Risk Scorecard" to assist in this effort.

Appendix A: Ad-Hoc Risk Assessments

Appendix B: Common Information System Assets

Appendix C: Common Threats

Appendix D: Vulnerabilities

Security Risk Management Guide Tools and Templates.msi

This file includes the Security Risk Management Guide Tools and Templates folder which contains the following files:

- SRMGTool1-Data Gathering Tool.doc
- SRMGTool2-Summary Risk Level.xls
- SRMGTool3-Detailed Level Risk Prioritization.xls
- SRMGTool4-Sample Project Schedule.xls
- Microsoft Software License Terms.doc

Copyright and license agreement

© 2006 Microsoft Corporation. This work is licensed under the Creative Commons Attribution-NonCommercial License. To view a copy of this license, visit http://creativecommons.org/licenses/by-nc/2.5/ or send a letter to Creative Commons, 543 Howard Street, 5th Floor, San Francisco, California, 94105, USA.