Hackers Underworld 2: Forbidden Knowledge/Hackers Underworld 2: Forbidden Knowledge.iso/HACKING/RISKTOOL.TXT

Text File | 1994-07-17 | 33.2 KB | 964 lines

          RISK MANAGEMENT RESEARCH LABORATORY OVERVIEW


The National Institute of Standards and Technology (NIST) and the
National Computer Security Center (NCSC) have cooperatively
established a Risk Management Research Laboratory located at the NIST
facilities in Gaithersburg, MD.

The primary objective of the laboratory is to conduct research in risk
management techniques and methodologies.  As part of this endeavor,
risk management software products will be surveyed to determine their
applicability to different agency environments.  A demonstration
capability is also planned.  Although official product evaluations
will not be conducted, reports outlining the characteristics and
capabilities of products surveyed will be prepared.

An additional goal of the laboratory is to develop and publish
guidance on currently available risk management methods.  We plan to
develop a "standard" test case for use in the laboratory.  The test
case will provide a focal point for controlled analysis and
documentation.  It is further planned to develop data on computer
security incidents for estimating threat frequencies, vulnerabilities,
losses, direct and indirect impacts, etc.

A longer range goal of the laboratory is to develop and validate a
formal framework for analyzing, developing, and implementing risk
management methods.  We will be looking for methods of risk management
which could be economically employed across a broad spectrum of
computer environments and upon which standards could be based.  It is
intended that workshops will be organized to evaluate current and
future technology for this purpose.

Technical contributions and comments are welcome from interested
parties from both the public and private sectors.  The point of
contact for the laboratory is Irene Gilbert (NIST),
[phone].
                  Application Control Matrix

Methodology. Matrix approach. This methodology presents application
controls, control objectives, and risks in a mate format. The matrix
provides a summary of the security environment which allows the user
and auditor to quickly view where added safeguards are needed.  A data
base of controls from which to make selections is included in this
software package.

Hardware Requirements.

- IBM PC or compatible.
- Two diskette drives or one diskette drive and a fixed drive.

Operating System.

- MS-DOS Version 2.0 or later.

Laser Interface~ease of Use.

- Menu-driven.
- Online HELP facility.

Documentation and Training.

- User Manual.

Developer/Vendor. Nander Brown & Co., Reston, VA [phone].
Remarks.
Government agencies may obtain copies of this software at no charge.
           BDSS (Bayesian Decision Support System).
Methodology.  Quantitative/Qualitative.  BDSS is programmed to gather
tangible and intangible asset valuation data and to ask questions that
assess potential risks using quantitative data bases provided by the
vendor.  The user can include site-specific threat experiences which
the algorithms will process along with the quantitative knowledge
base. Threats, vulnerabilities, asset categories, and selected
safeguards are automatically mapped and cross-mapped to each other.
system ranks threats before and after the implementation of safeguards
so that the representation of comparable exposure to loss may be
examined. The analysis results are typically displayed graphically
with risk curves based on dollar loss values and probability of loss
coordinates. The central algorithms of BDSS are based on Bayes'
Theorem addressing uncertainty and statistical methods. BDSS software
produces a variety of printed reports as well as ASCII files that may
be exported to the user's word processor.  The vulnerability analysis
feature of the BDSS application also provides a stand-alone
qualitative presentation of safeguard system weaknesses.

Hardware requirements.

- IBM PC/AT or compatible.
- 640KB memory.
- 20MB fixed drive and one diskette drive.
- Graphics card (CGA/EGA)

Operating System.

- MS-DOS Version 3.0 or later.

User Interface/Ease of Use.

- Menu driven.

Documentation and Training:

- User manual.
- Training is not included with purchase but may be provided
  upon request.

Developer/Vendor.  Ozier, Perry & Associates developed BDSS in a joint
venture with Pickard, Lowe and Garrick, Inc. of Newport Beach, CA and
Washington, DC. For further information regarding the software contact
Ozier, Perry & Associates, San Francisco, CA; [phone]

Remarks.                           BUDDY SYSTEM

Methodology. Qualitative. The Buddy System is an automated risk
analysis methodology for microcomputer environments and comprises two
components: (1) countermeasures survey and (2) security analysis and
management (SAM). This software package assesses the level of
vulnerability based on safeguards already in place. The level of
information being processed on the system determines whether or not
the assessed level of vulnerability is acceptable. Recommendations for
corrective action are provided for each vulnerability that falls
outside of the acceptable range through the use of on-line "what if'
scenarios.  A data base containing over 100 safeguards is included in
this software package. Further, the Risk Management component of the
system allows the analyst to track recommended corrective action
implementations for reports and/or follow-up procedures.

Hardware Requirements.

- IBM PC or compatible.
- 256KB memory.
- 10MB fixed drive and one 360K diskette drive.

Operating system.

- MS-DOS Version 2.0 or later.

User Interface/Ease of Use.

- On-line HELP facility.

Documentation and Training.

- User manual.
- One-day on-site training course.
- Training component built into the software to increase security
  awareness.

Developer/Vendor: Countermeasures, Inc., Hollywood, MD; (301) 373-
5166.

Remarks.

- Optional Maintenance Utility allows the user to customize the
  software.
- Report and screen formats can be edited with standard DOS
  editor.
         CONTROL MATRIX METHODOLOGY FOR MICROCOMPUTERS

Methodology.  Matrix approach. This software provides a matrix
approach for designing controls into microcomputer system
environments.  It identifies which controls are necessary to ensure
adequate security in business or scientific systems.  The software
package contains four separate systems.

Package 1 (Designing Controls into Computerized Systems) is an
educational tool that teaches the user how to design and develop a
control matrix.

Package 2 (Risk Ranking the Matrix) teaches the use of Delphi and
Comparison Risk Ranking techniques to rank threats and their controls.

Package 3 (Automated PC-Based Control Matrix Design) is a control
matrix development package that contains a database of controls plus
separate databases of threats and computer system components. This
package allows one to draw a draft matrix, search the controls
database and move relevant controls to a matrix controls list.

Package 4 (Show Text Presentation Graphics) is used to draw the final
matrix resequencing threats, components, and controls.

Hardware Requirements.

- IBM PC or compatible or IBM Personal System/2.
- 384KB memory.
- Two diskette drives or 10MB fixed disk.
- Graphics capability.

Operating system.

- MS-DOS Version 2.0 or later.

User Interface/Ease of Use.

- A demo diskette provides a ten minute introduction to the
  matrix concept of designing controls into computerized systems.

Documentation and Training.

- User manual.
- Automated course.
- One or two day on-site training upon request.

Developer/Vendor. Jerry Fitzgerald & Associates, Redwood City, CA
[phone]

Remarks.

     CRAMM (CCTA Risk Analysis and Management Methodology)

Methodology:  Qualitative.  CRAMM is a risk analysis tool developed by
the British government and BIS Applied Systems Limited.  CRAMM is
composed of three stages, each supported by questionnaires and
guidelines. The primary function of Stage 1 is the valuation of data
and physical assets of the system or network under review. Qualitative
values are determined for the data assets on a scale of 1 to 10, for
potential impacts of disclosure, modification, destruction, and
availability. The physical asset are valued on the basis of
replacement costs, which are also convened to scalar values of 1 to
10, with 10 representing the highest value. The review moves to stage
2 for those assets valued higher than 3. (Baseline protective measures
are recommended for assets valued lower than 3).

Stage 2 measures the levels of threats and vulnerabilities for each
asset group and then measures the risks on a scale of 1 to 5. In stage
3, these measures are used to select safeguards from a library of over
900.  CRAMM provides an iterative safeguard evaluation, in priority
sequence, to facilitate selection of the most appropriate safeguards.
A variety of reports are produced. CRAMM also provides a password
logon function. Sensitivity markings are provided on all screens and
hardcopy output.

Hardware Requirements.

- IBM PC or compatible.
- 640KB memory.
- 10MB fixed drive.

Operating System.

- MS-DOS 2.1 or later.

User Interface/Ease of Use.

- Menu-driven.
- On-line HELP facility.

Documentation and Training.

- User manual.
- Management guide.
- Training available upon request.

Developer/Vendor. BIS Applied Systems Limited, London SE1 9PN,
England; telephone [phone].

Remarks. CRAMM is available in the USA by licence agreement between
BIS and the UK Central Computer Telecommunications Agency. The BIS
Service Representative and provider of a US-based help desk and
support services is Executive Resources Associates, Inc., Suite 813,
One Crystal Drive, Arlington, VA 22202; [phone].CRITI-CALC

Methodology: Quantitative/Qualitative. This product uses the concept
of annualized loss expectancy (ALE) to quantify the criticality of
risk exposure for applications. The software collects information
about each application's loss potential, optimum off-site recovery,
cost of backup, cost 10 recover.  It uses this information to
calculate each application's annualized risk potential. The
criticality of each application is determined by the potential for
loss caused by a processing interruption and a profile of up to 14
delay factors. The user interacts with the system by means of screens
which display information about the risk exposure.  Once the user has
reviewed the initial results, "what if" analysis may be performed by
modifying the input data as a way of verifying the effectiveness of
certain safeguards.  The information contained in the output reports
may be used to optimize contingency plans.  The ALE, as a function of
maximum outage duration, is compared with the corresponding cost of
backup data to identify automatically the optimum off-site recovery
site.

Hardware requirements:

- IBM PC/XT or compatible.
- 64OK memory.
- 360K diskette drive.
- Feed drive not necessary but convenient.

Operating SYstem:

- MS-DOS Version 2.11 or later.

User Interface ease of Use:

- Menu-driven.
- Help screen.

Documentation and Training:

- User manual with sample databases and detailed tutorial.
- On-site training.

Developer/Vendor: International Security Technology, Reston, VA (703)
471-0885.

Remarks.
                            GRA/SYS

Methodology.  Qualitative.  GRA/SYS is a tool designed to assist
internal auditors and security personnel in developing a work priority
plan for reviewing organizational risks. Specifically, the software
prepares an applications and computer activity inventory, determines
the number of risks for several major control areas. A risk score that
reflects the measure of risk to the organization is calculated and
placed in descending order on a scale of 1 to 9, with 9 representing a
worst-case situation.  An additional report that reflects the number
of times each risk occurs is also prepared. Using the output reports
from this software package, the user is able to identify those risks
where more effective safeguards are needed.

Hardware Requirements.

- IBM PC or compatible.
- 64KB memory.
- One diskette drive.

Software Requirements.

- MS-DOS Version 2.0 or later.

User Interface/Ease of Use.

- Menu-driven.

Documentation and Training.

- User manual.
- Training is not offered with the purchase.


Developer/Vendor.  Nander Brown & Co., Reston, VA.;
[phone].

Remarks.

Government organizations may obtain this software at no cost.
   IST/RAMP (International Security Technology/Risk Analysis
                       Management Program)

Methodology. Quantitative and Qualitative. 1ST/RAMP is a mainframe-
resident risk analysis program with an input module that is PC-
resident. The software calculates the annualized loss expectancy and
as well as single occurrence loss.  The system can also provide a
qualitative analysis.  1ST/RAMP generates data collection forms to
assist the risk analyst in organizing and controlling data collection.
Five loss categories are addressed: service interruptions; physical
loss and damage; fraud; unauthorized disclosure; and physical theft. A
library of data bases enables the analyst to maintain an audit trail
of input data changes. A 'what-if' capability enables the analyst to
select the most cost-effective security measures.

RAMP<->LINK~is a PC-resident, menu-driven data entry system which uses
risk information entered by the analyst to build a DOS file that can
be uploaded to IST/RAMP for processing.

Hardware Requirements.

- IBM Mainframe for IST/RAMP--30xx with MVS.
- Interactive under TSO and Roscoe.
- IBM PC/XT or compatible for RAMP<->Link.
- 5K12 memory.
- Two diskette drives or one diskette and fixed disk drives.

Software Requirements.

- MS DOS Version 2.1 or later.

User Interface/lEase of Use.

- Menu-driven.

Documentation and Training.

- Training manual with sample data bases and detailed tutorial.
- User manual.
- Three-day on-site training.
- Pocket reference.

Developer/Vendor International Security Technology, Reston, VA; (703)
471-0885.

Remarks.

RAMP<->L~ makes it unnecessary for the analyst to be familiar with the
details of 1ST/RAMP data entry formats.  The analyst enters the data
off-line and logs onto a mainframe where 1ST/RAMP is resident using
any communications software package that has a "file send" command.
                            JANBER

Methodology:  Qualitative.  Janber initiates a yes/no questionnaire
and checklIst for collecting information about security controls
already in place. The software weights safeguards currently in place
and measures them against the level of data being processed on the
system. These data classification levels point to highly sensitive but
unclassified information to highly classified data. The analysis
provides a linguistic characterization of the level of vulnerability
from 2-28, with 28 representing a worst-case scenario.
Vulnerabilities, safeguards and their weights can be preestablished by
the vendor to meet the organization requirements. Safeguards that are
required but not implemented are flagged in a report and
recommendations for safeguards that meet organizational guidelines and
directives are provided. Users have the capability of performing
"what-if' scenarios to evaluate the effectiveness of certain
safeguards.

The Janber application allows users to define standard entries for
specific data fields.  The results of the data collection and analysis
are maintained on separate data bases. The developer recommends that
both the analysis and the data collection be performed by different
personnel to assure the integrity of the results.  The developer
further recommends that the analysis be performed by computer security
professionals to achieve optimum results.  The software provides a
capability to track action items resulting from the evaluation.

Janber creates a database of information on all systems surveyed and
provides a data base query capability for contingency planning and
recovery operations.

Hardware Requirements.

- IBM PC or compatible.
- 10MB Feed drive and one diskette drive.

Operating system.

- MS-DOS Version 2.0 or higher.

User Interface/Ease of Use.

- Menu-driven.
- On-line help facility.

Documentation and Training.

- User manual.
- Training provided upon request.

Developer/Vendor. Eagan, McAIlister Associates, Inc., Lexington Park,
MD 20653; [phone].

Remarks.LAVA (Los Alamos Vulnerability and Risk Assessment)

Methodology:  Qualitative and Quantitative.  LAVA administers
questionnaires which results in the identification of missing
safeguards in 34 areas ranging from password management to personnel
security and internal audit practices.  The software evaluates
potential consequences and impact upon the organization and the
ultimate loss exposure (risks). LAVA considers three kinds of threats:
natural and environmental hazards; accidental and intentional on-site
human threats (including the authorized insider); and off-site human
threats. Detailed LAVA reports provide both qualitative and
quantitative results of the risks identified.

Hardware requirements.

- IBM PC- or compatible.
- 512KB memory.
- 360KB and 720KB diskette drives; or 1.2MB fixed drive and
  one 360~ diskette drive.

Operating System.

- MS-DOS Version 2.0 or later.

User Interface/Ease of Use.

- Interactive questionnaires.

Documentation and Training.

- User manual.
- On-site training.
- Demonstration diskette.

Developer/Vendor.  Los AIamos National Laboratory, Los AIamos, NM;
[phone].

Remarks.

The LAVA methodology stresses a team approach for conducting the risk
assessment.  It is recommended the team be composed of people with a
broad spectrum of backgrounds and expertise to ensure a thorough
assessment. It is further recommended that a consensus among the group
be reached before entering an answer to any of the questions, and that
in some cases this may be the most difficult part of administering
this risk management software.

Distribution of this package is handled through the National Security
Agency (contacts include Sam Samuelson (301)~688-6022; Ed Markel (301)
688-6022; or John LaPaille [phone].
          LRAM (Livermore Risk Analysis Methodology)

Methodology: Quantitative. A government-developed system, this
methodology is structured to allow screening of asset/threat-event
combinations so that only high impact risks are reviewed. The
methodology focuses attention on the effectiveness of proposed
security controls as well as those already in place. LRAM is divided
into three major phases to include project planning, risk analysis,
and decision support. The initial phase defines the scope of the
analysis and identifies needed resources and personnel. The second
phase analyzes the data collected from phase 1.  In this second phase,
risk elements are identified by establishing corresponding threats,
control and asset components, the results of which are provided as
input for the final decision support phase.

The final decision support phase is meant to assist in the security
management of information. It is a process to select and list in
priority order each recommended safeguard on the basis of cost benefit
estimates and other decision indexes.

Hardware Requirements.

- IBM PC or compatible.
- 640K memory.
- One diskette drive and fixed drive.

Operating SYstem.

- MS-DOS Version 2.0 or later.

User Interface/Ease of Use.

- Menu-driven.

Documentation and Training.

- User manual.


Developer/Vendor~ Lawrence Livermore National Laboratory, Livermore,
CA; [phone] or 543-3082.

Remarks.
                         MARION

Methodology.  Qualitative/Quantitative. LION assesses business risks
associated with information systems drawing on a large database of
actual incidents. The software incorporates a questionnaire to
evaluate the level of security that is currently being applied within
the organization. Each question is allocated a weighting which
reflects the relative importance according to the analysis of the
underlying database of events. A score is allocated for each question;
the responses and scores are stored. The software calculates the
overall score for 27 categories of security and presents the results
graphically and in printed form.  Once the current security profile
has been determined, MARION compares each category with industry norms
which are derived from the database. The software uses the information
on costs also held iii the database to calculate an estimated
expenditure in relation to the total security budget. The calculated
costs are analyzed according to the nature of the security category
and presented graphically in detailed tables.  A "what-if" capability
allows one to use different budgets to determine the effects on the
security profile. The effects of the proposed measures can also be
displayed.

Hardware Requirements.

- IBM PC or compatible.
- 5l2K memory.
- Graphics capability.

Operating System.

- MS DOS 2.0 or later.

User Interface/Ease of Use.

- Menu-driven.

Documentation and Training.

- User Manual.

Developer/Vendor.  Coopers & Lybrand (United Kingdom firm), Plumtree
Court, London EC4A 4HT, telephone [phone].

Remarks.

MARION is a methodology developed in France. Coopers & Lybrand are the
agents for the package in the UK.  They have worked with a French
software house PSI to produce an English version of the package and
supporting reference material.

                  MicroSecure Self Assessment

Methodology. Qualitative. An automated software tool that will allow
PC users to conduct a security self-assessment.  The software analyzes
the PC environment, determines the vulnerabilities, and recommends
security controls.  Those safeguards recommended are designed to
increase security and reduce exposures in six areas to include system
integrity, data security, credibility, data integrity, backup and
disaster recovery, and confidentiality and privacy.  The software may
be customized to meet specific requirements.

Hardware Requirements.

- IBM PC or compatible.
- 256K memory.
- One diskette drive.

Operating System.

- MS DOS 2.0 or later.

User Interface/Ease of Use.

- Menu-driven.

Documentation and Training.

- User Guide.
- On-line tutorial.

Developer/Vendor Boden Associates, East Williston, NY;
[phone].

Remarks.  An optional question quiz is provided at the end of each
chapter of the training course. Recommendations for corrective action
can be printed directly to the printer or written to an ASCII text
file for editing.
                           MINIRISK

Methodology. Qualitative. MINIRISK is a tool designed to assess
computer security vulnerabilities in a micro computer environment.  A
vulnerability assessment questionnaire allows the organization to
evaluate the adequacy and completeness of individual safeguards areas
and to reevaluate these same areas after missing safeguards have been
implemented. During the process of answering the MINIRlSK
questionnaire, the user identifies missing safeguards in 10 to 50
vulnerability categories ranging from password management to
contingency planning and internal audit controls.  Safeguards and
controls considered mandatory by the organization have been appointed
for each category that is to be reviewed. The absence of certain
safeguards determines the level of vulnerability on a scale of zero to
9, with zero being the best case, and 9 the worst.  MINIRISK
establishes a threshold by which to evaluate vulnerabilities that
exceed an acceptable risk level.


Hardware Requirements.

- IBM PC or compatible.
- 64KB memory.
- One diskette drive.

Software Requirements.

- MS-DOS Version 2.0 or later.

User Interface/Ease of Use.

- Menu-driven.
- Online HELP facility.
- User defined questionnaire.

Documentation and Training.

- User manual.
- Training is not offered with the purchase.

Developer/Vendor.  Nander Brown & Co., Reston, VA.; [phone].

Remarks.  Government organizations may obtain this software at no
cost.
    PRISM Risk Analysis and Simulation for the PC

Methodology. Qualitative. Prism supports development of risk analysis
modelling, simulation, sensitivity analysis, and graphical
presentation of results. It also contains system functions to save,
retrieve, display, and modify existing models. In addition to simple
algebraic equations, Prism permits use of BASIC-like statements to
model more complex applications.

Hardware Requirements.

- IBM PC or compatible.
- 512K fixed drive.

Operating System.

- MS-DOS 2.0 or later.

User Interface/lEase of Use.

- On-line HELP facility.

Documentation and Training.

- User manual.
- Training and on-site seminars.
- Consulting services available to assist in model development.

Developer/Vendor. Palisade Corporation, Newfield, NY;
[phone].

Remarks.
                           QUICKRISK

Methodology:  Qualitative.  Quikrisk requires the user to input
information about the systems and facilities on a scenario form. These
forms pertain to potential threats, current safeguards, and assets.
Once all of the input information has been entered, the software
computes the results which provide an annual loss exposure. An
additional computation is performed which displays a return on
investment for each control in place.  The analyst also has the
capability of modifying the results of previous computations by
modifying the input data.  In addition, the software is delivered with
a threat file containing numerous threats and frequencies. The user
has the capability of adding threats to this list.


Hardware requirements.

- IBM PC or compatible.
- Two diskette drives.

Operating System.

- MS-DOS Version 2.0 or later.

User Interface~se of Use.

- Menu-driven.

Documentation and Training.

- User manual.

Developer/Vendor Basic Data Systems, Rockville, MD;
[phone].

Remarks.
                     RANK-IT
Methodology. RANK-IT is a risk assessment software package that uses
the Delphi technique. Delphi is an expert system approach to risk
ranking. This software automates the Delphi technique by adding
Comparison Risk Ranking to obtain an ordinally ranked list of the
items being ranked or to calculate percentage risk values.  Each
ranked item has a numerical value that can be used as a weighting
factor or a cardinal number value.

RANK-IT is used to risk rank system threats, controls,
vulnerabilities, components, or any other criteria. It also can be
used to rank other types of business decision alternatives, whether
quantifiable or not.

The developer suggests that the time required to conduct a risk
ranking using this combined Delphi and Comparison Risk Ranking
methodology can range from 30 minutes to three hours.

Hardware Requirements.

- IBM PC/XT/AT or compatible or IBM Personal System/2.
- 5l2KB memory.
- Single diskette drive or fixed disk (300K memory required).
- Graphics capability.

Operating System.

- MS-DOS Version 2.0 or later.

User Interface/Ease of Use.

- Menu-driven.

Documentation and Training.

- Demonstration diskette.
- User manual.
- Tutorial and training diskettes.
- One-day on-site training upon request.

Developer/Vendor.  Jerry Fitzgerald & Associates, Redwood City, CA;
[phone].

Remarks.
                 Risk Analysis System (RA/SYS)

Methodology.  Quantitative. RA/SYS is an automated risk analysis
system which processes with a series of interconnected files that can
assess up to 50 vulnerabilities and assets and 65 threats.
Calculations are performed on threat/vulnerability pairs to produce
threat ratings and threat frequencies. A report summarizes loss
estimates, cost benefit analysis, and return on investment.

Hardware Requirements.

- IBM PC or compatible.
- 128KB of memory.
- Two 360KB diskette drives or 640KB fixed drive.

Operating System.

- MS-DOS Version 2.0 or later.

User Interface/Ease of Use.

- Menu-driven.
- On-line HELP facility.

Documentation and Training.

- User manual.
- Technical assistance available upon request.

Developer/Vendor Nander Brown & Co., Reston, VA;
[phone].

Remarks.

Government agencies may obtain copies of this software at no charge.
                          RiskCALC

Methodology.  Quantitative or Qualitative.  An annual loss expectancy
(ALE) or other metric is computed based on an answered questionnaire.
The user may optionally change the values of RiskCALC variables to
determine the most cost-effective safeguards and display the results
on the user's screen. RiskCALC is part of a 'family' of software tools
described below. They each provide a standard ASClI file interface for
exporting and importing RiskCALC variables.

      o  RiskCALC allows the user to answer questions and print
reports into which values elicited from the questionnaire are
automatically inserted.

      o Risk Minimizer identifies an organization's most
significant risks from a completed analysis. Risk Minimizer may be
used with other risk management software tools that use the RiskCalc
file format.

      0  The System Manager assists in designing or customizing an
existing risk analysis model.

      o  The Demonstration Models allow the user to develop a
site-speciiic questionnaire or select one that models several risk
scenarios.

Hardware requirements.

- IBM PC or compatible.
- 5I2KB memory.
- Fixed drive is optional but recommended.

Operating system.

 MS-DOS Version 2.1 or later.

User Interface/Ease of Use.

- Menu driven.
- On-line help facility.
- Lotus-like iriterface.

Documentation and Training.

- User and system administrator manuals.
- One day on-site training with purchase.
- A three-day course on computer security and risk management
  is available upon request.

Developer/Vendor.  Hoffman Business Associates, Inc., Chevy Chase,
MD., [phone].

Remarks
                            RISKPAC

Methodology.  Qualitative.  This software product is composed of three
components--questionnaire, surveys, and reports. The results of the
questionnaire are stored in a 'survey' which provides the basis of the
analysis.  The questions point to discrete categories that provide a
review of an organization's policies, physical environment, processing
hardware and the applications and data which make up a system.  Each
of these categories are evaluated separately. A variety of
questionnaires that apply to several disciplines (e.g., manufacturing,
banking, and government) are available.  'Reports' provide the results
of the evaluation expressed on a scale of one to five, with five
representing a worst-case scenario. The weighting and scoring
algorithms are based on Kepner/Tregoe type of analysis. The package
can produce data files that can be input to various database spread
sheets.  Further, the software is equipped with a number of utility
routines that allow organizations to develop their own questionnaires.
This 'System Manager' capability is available separately.

Hardware Requirements.

- IBM PC, PC/XT, or PC/AT or compatible.
  256K ofmemory.
- Two diskette drives or 10MB fixed drive.

Operating system.

- MS-DOS Version 2.0 or later.

User Interface/Ease of Use.

- Menu-driven.

Documentation and Training.

- User manual.
- Training provided upon request.

Developer/Vendor:  Computer Security Consultants, Ridgefield, CT,
Subsidiary of Computer Security Consultants, LTD.; [phone].

Remarks.
                             RISKWATCH

Methodology.  Qualitative/Quantitative.  The RISKWATCH software is
capable of analyzing organizations, facilities, systems, applications
and networks, both large and small.  RiskWatch distinguishes between
financial, critical, sensitive and classified systems. The system
access relational data bases that contain over thousands of
relationships between threats, assets, vulnerabilities, losses, and
safeguards. Responses to a questionnaire which addresses a wide
variety of job functions is combined with the databases to produce a
comprehensive risk analysis report. This report also provides an asset
inventory, a detailed list of vulnerabilities, threat analysis with
annual loss expectancies and recommended safeguards that include
return-on-investment. The system provides a query capability for any
selected threat, asset, vulnerability or safeguard.

Hardware requirements.

- IBM-XT/AT or compatible.
- 640K memory.
- 10MB fixed drive.
- Graphics.
- Color monitor.

Operating system.

- MS DOS Version 2.1 or higher.

User Interface/Ease of Use.

- Menu-driven.

Documentation and Training.

- User manual.
- Training provided upon request.

Developer/Vendor. Expert Systems Software, Inc., Long Beach, CA
[phone].

Remarks.

The software can be customized to meet the needs of both defense and
civil organizations.  LOGICON is authorized to distribute this
software package, Arlington, VA [phone].


Downloaded From P-80 International Information Systems 304-744-2253