CXOToday.

com Page 1 of 1

SISA Completes OCTAVE Assessment For Ascendus

SISA Information Security Pvt. Ltd., a information security consultancy firm,

has completed the OCTAVE (Operationally Critical Threat, Asset, and
Vulnerability Evaluation) assessment for Bangalore-based Ascendus
Technology.

Speaking to CXOtoday, Darshan Shanthamurthy, director-operations, SISA

Information said, "This is the second client in the last two months to have
assessed their security risks through OCTAVE technology.' It took two
weeks for the risk assessment process at Ascendus, and four weeks for the
company's earlier client, the Software Technology Park of India (STPI), Bangalore.

The total cost of the assessment process depends on the amount of time taken to complete it. Shanthamurthy added, "For a
300 employee organization, the assessment would take roughly two weeks for a single location, the cost of which would work
out to roughly Rs 1 lakh. The figure could be as high as Rs 50 lakh for an organization with 10,000 employees spread over
multiple locations, for which the assessment process would take around four weeks."

It is a general practice among bigger IT users to have an IT audit mechanism in place for regular cross evaluations against
standards. However, risk assessment is a prime necessity as Santhamurthy explained, "In IT audits the evaluation is done
against standards, whereas in risk assessment the locational, technical, and business related risks are evaluated, to give the
enterprise a clear picture of where it stands as far as business security is concerned."

OCTAVE is a methodology for security risk assessment formulated by the Software Engineering Institute (SEI) of Carnegie
Mellon University (CMU) USA, under which all information assets and related physical assets of an enterprise are evaluated.

Ascendus Technologies, which helps universities especially in the US, to develop web-based survey software applications,
has used this risk assessment method for ensuring its credibility to its clients. Ascendus Technologies (India) CEO, Vikram
Kumar, said, "Our clients wanted to be assured of our credibility in business processes, which is why we went for the risk
assessment based on OCTAVE."

SISA, together with STPI-Bangalore, is organizing its second OCTAVE (SEI-CMU) Information Security Risk Assessment
Training workshop from March 4-6, 2004 in Bangalore, the detailed information for which is available here. The event has
already received confirmed participation from the likes of Wipro, Paragon Technologies, and ITC Infotech.

As more and more IT enterprises offer their services to clients abroad, OCTAVE risk assessment is poised for wider
acceptance amongst Indian IT enterprises.

Find this article at:

http://www.cxotoday.com/cxo/jsp/article.jsp?article_id=672&cat_id=908

http://www.cxotoday.com/cxo/jsp/article.jsp?print=1&article_id=672&cat_id=908 04-Dec-07