Re: OCTAVE

[Mark Rogowski <m.rogowski () UWINNIPEG CA>]

Hi Carol,

Thank you very much for responding.  I suppose I should have qualified
things a bit better in my questions, citing that we are not overly large
by comparison to others (~10,000 student base).  I will certainly look
over the OCTAVE S portion, once I can convince our risk management
department this is the way to go.  There is a definate gap between risk
management and IT here and I intend to close it.

If you don't mind me asking, how big is Paradise Valley and did you
call in a consultant to help you along with implimenting each phase?  Do
you have the technical expertise on hand to perform Phase 2?  Did you
hit any hurtles when trying to coordinate Phase 1?

Thanks for the links, and I would LOVE to receive any docs you wish to
share.

Best regards,



Mark Rogowski
IT Security
Technology Solutions Centre
University of Winnipeg
Ph: (204) 786-9034

> > > carol.myers () PVMAIL MARICOPA EDU 12/09/05 10:08 AM >>>
Mark,

I have found OCTAVE very useful due to its ability to be modified for
specific campus needs.  As you may be aware OCTAVE was designed
initially for federal government so at first blush it may seem very
complex.  The methodology is sound and I found the forms to be most
useful.  Your institution's risk climate would dictate whether or not
you would use outside help for a full blown OCTAVE implementation, or
simplify and modify as needed.  I used an intern to sift and craft
OCATVE materials that would work my institution.  You may also want to

check out OCTAVE S for smaller institutions.

Helpful assessment materials and other useful information is available

through the Educause/Internet2 Security Task Force.  Do look here
http://www.educause.edu/Browse/645?PARENT_ID=665
and here http://www.educause.edu/EffectiveSecurityPracticesGuide/1246

Happy to share documentation if you like.  Good luck to you.

Carol

--

Carol Myers, CISSP
Information Resources & Technology Support
Paradise Valley Community College
602.787.7788

"One ought, every day at least, to hear a little song, read a good
poem, see a fine picture, and, if it were possible, to speak a few
reasonable words."
                        --Johann Wolfgang von Goethe