Skip to main content

Risk management for IT (CRAMM Lite)

Meerkats are one of the more risk aware animals. One or more meerkats stand sentry (lookout) while others are foraging or playing, to warn them of approaching dangers. When a predator is spotted, the meerkat performing as sentry gives a warning bark, and other members of the gang will run and hide in one of the many bolt holes they have spread across their territory. The sentry meerkat is the first to reappear from the burrow and search for predators, constantly barking to keep the others underground. If there is no threat, the sentry meerkat stops signaling and the others feel safe to emerge. Thus in the spirit of the Meerkat's I present CRAMM Lite.
CRAMM provides a staged and disciplined approach embracing both technical (e.g. IT hardware and software) and non-technical (e.g. physical and human) aspects of security. In order to assess these components, CRAMM is divided into three stages:
  • Asset identification and valuation
  • Threat and vulnerability assessment
  • Countermeasure selection and recommendatio
The full blown CRAMM methodology is too cumbersome to use for ad-hoc assessment as those encountered in major incident reporting or small projects. CRAMM Lite forms part of a greater impact analysis (Risk, Outage and Classification). In CRAMM Lite the asset, process or resources involved are measured from a risk perceptive. Three areas are assessed. Each area has a maximum score of 4 and the grading is the score of all areas represented as a percentage.
  • Impact - CIA(Confidentiality, integrity and availability) are scored.
  • Vulnerability - Loss(C), error(I) and failure(A) are scored.
  • Counter measures - Countermeasures already in place and those that will be implemented in the future are scored.
The impact is rated as 4 – Critical – Confidentiality = Secure, Integrity = Very high, Availability = Mandatory. The impact is rated as 4 – High loss probability, High error probability, High failure probability. Counter measures is rated as 2 – Service provider due diligence. The score is thus 10 out of a max of 12 = 84%.

CRAMM Lite is used in the Major Incident Process.  Read about this process here.


Popular posts from this blog

LDWin: Link Discovery for Windows

LDWin supports the following methods of link discovery: CDP - Cisco Discovery Protocol LLDP - Link Layer Discovery Protocol Download LDWin from here.

easywall - Web interface for easy use of the IPTables firewall on Linux systems written in Python3.

Firewalls are becoming increasingly important in today’s world. Hackers and automated scripts are constantly trying to invade your system and use it for Bitcoin mining, botnets or other things. To prevent these attacks, you can use a firewall on your system. IPTables is the strongest firewall in Linux because it can filter packets in the kernel before they reach the application. Using IPTables is not very easy for Linux beginners. We have created easywall - the simple IPTables web interface . The focus of the software is on easy installation and use. Access this neat software over on github: easywall

Using OpenSSL with Ed Harmoush 1/6 Generating Public & Private Keys