By Arun Sood

Information is critical to decision making in a corporation. Companies are beginning to apply risk management approaches to managing the IT infrastructure.  Vendors like Symantec and McAfee are also responding to this need.  Proactive Risk Management methodology enables the study of a variety of trade-offs.  However, for quantitative security risk management, it is necessary to have a quantitative metric.  The lack of easily measurable and understandable metrics is a big hole in the conventional reactive models of prevention and detection.
(more…)