Risk Scoring Method on Business Information Management System

are often exposed to many kinds of threats, which become major risk factors of their business activities. In order to make a risk protection strategy and select mitigation controls to reduce the risks triggered by these factors, the information risks should be properly evaluated in the first stage. We focus on the risk profile work sheet of OCTAVE, one of the important information risk management systems, and propose a method to give a numerical value to each of business impact along the definite threat path and its probability. Our proposed method is based on CVSS which is one of the scoring methods to possible vulnerabilities in information network system. CVSS itself was developed to give a vulnerability score on the technical matters such as buffer overflow, cross-site scripting, etc., using several indices classified into impact items and frequency items. We use these indices and calculation formulae to give the impact and probability values on OCTAVE’s threat work sheet by giving correspondence between each of their indices