Disclaimer: The opinions of the columnists are their own and not necessarily those of their employer.
Jeff Lowder

The Difference between Quantitative and Qualitative Risk Analysis and Why It Matters (Part 2)

Jeff Lowder writes the column Agile Security: Balancing Security with the Need for Agility
By Jeff Lowder posted in General • October 29, 2008 • 6:00am
Pages: 1 2 3 4 5

Objective vs. Subjective Approaches: Strengths and Weaknesses

As we have seen, quantitative risk analyses can be subjective and qualitative risk analyses can be objective. The purpose of this slide is to summarize and discuss some of the advantages and disadvantages of both the objective and subjective approaches to risk analysis.

 

Objective

Subjective

Pros
  • More accurate
  • Evidence not needed

 
  • Risk management performance can be tracked objectively
  • Cheaper

 
  • Easier to prioritize risks
  • Faster

 

 
  • Easier

 

 

Cons
  • Requires evidence
  • Less accurate

 
  • Expensive
  • Less buy-in

 
  • Time-consuming
  • Difficulty in prioritizing risks

 
  • Lack of granular data regarding specific security threats
  • Difficulty in tracking risk management performance objectively

 
  • Cynical attitudes (“you can prove anything with statistics”)
  • Cynical attitudes (“this is all subjective”)

Popularity: 11%

Pages: 1 2 3 4 5
Bookmark this post
•Sphere: Related Content•
Popularity: 11%
• Print Print
Related Articles:
, , , , , , , , , , , Post a comment or leave a trackback: Trackback URL.

Post a Comment

Your email is never published nor shared. Required fields are marked *

*
*