OCTAVE: Asset-Driven Risk Assessment and How It Compares to STRIDE

OCTAVE is a risk assessment method built on one premise: the people who know which assets matter are the business, not the security team. It works from critical assets and business impact toward technical controls, which is the opposite direction from most technical threat modelling, and that difference is what the exam is testing when it appears.

What makes it different

Most technical methods start with a system and enumerate what could go wrong with it. OCTAVE starts by asking the organization which handful of assets it genuinely could not operate without, then works out what threatens those.

It is self-directed — run by an internal team drawn from across the business rather than by outside consultants — and it is operationally focused, concerned with organizational risk and practice rather than with a vulnerability list. The output is a protection strategy and mitigation plans, not a scan report.

The self-direction is deliberate. An external assessment produces a document; an internal one produces shared understanding among the people who will have to fund and implement the result. It also means the assessment is only as good as the participants you can get into the room.

The three phases

Phase 1: build asset-based threat profiles. Workshops with staff at several levels — senior management, operational managers, and technical staff — identify what the organization considers critical, what is currently done to protect it, and what worries people. From this a short list of genuinely critical assets emerges, usually five or so, each with a security requirement stated in business terms and a set of threat scenarios.

The multi-level structure matters: executives know what the business cannot survive losing, and the people doing the work know where the process actually breaks. Asking only one group produces a predictable blind spot.

Phase 2: identify infrastructure vulnerabilities. Now the technical work — which systems store, process, or transmit those critical assets, and what weaknesses those systems have. Scoping the technical assessment to the systems supporting critical assets is what keeps it tractable.

Phase 3: develop strategy and plans. Combine the threat profiles with the technical findings, evaluate impact and likelihood, and produce a protection strategy with prioritized mitigation plans and named owners.

The variants

The original method was designed for large organizations with the staff to run extended workshops. OCTAVE-S is a streamlined version for small organizations where a few people know the whole business and formal workshops are unnecessary.

OCTAVE Allegro is the version most likely to be used today. It narrows the focus to information assets specifically, and runs through eight steps built around worksheets — establishing risk measurement criteria tied to business impact, profiling each information asset, identifying the containers it lives in, and then working through areas of concern, threat scenarios, risks, and mitigation. It is considerably faster than the original and produces a comparable result for information risk.

The container concept in Allegro is worth remembering: an information asset lives in technical containers (servers, databases, cloud services), physical containers (paper, storage media), and people containers (staff who know it). Risk has to be assessed for each, and the people container is the one most often skipped.

Where it sits among other methods

OCTAVE is organizational and asset-driven. STRIDE is technical and system-driven, applied to a design or a data flow diagram to enumerate spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege. They answer different questions and are complementary rather than competing — OCTAVE tells you which systems deserve a STRIDE analysis.

Frameworks such as the NIST risk management process and ISO 27005 define a broader risk lifecycle into which either method can slot. Quantitative approaches attach monetary figures to loss, which is powerful for funding arguments and demanding in data.

Whichever method produces the assessment, the result depends on knowing what you have. An assessment run against an incomplete asset inventory misses exactly the systems nobody is tracking, which is why the CMDB is upstream of all of this. And the mitigation plans should end up as owned, dated actions in the same place as your other findings, connected to the response procedures in your incident response playbooks.

Exam angles

Identify OCTAVE as a self-directed, asset-driven, organizational risk assessment method with three phases: asset-based threat profiles, infrastructure vulnerability identification, and strategy and plan development. Know OCTAVE-S for small organizations and Allegro as the streamlined information-asset variant using containers. Contrast it with STRIDE as technical per-system threat modelling, and recognize that OCTAVE's distinguishing feature is starting from business impact rather than from technology.