us.springett.owasp.riskrating.factors

Class BusinessImpactFactor

java.lang.Object

us.springett.owasp.riskrating.factors.BusinessImpactFactor

public class BusinessImpactFactor
extends Object

The business impact stems from the technical impact, but requires a deep understanding of what is important to the company running the application. In general, you should be aiming to support your risks with business impact, particularly if your audience is executive level. The business risk is what justifies investment in fixing security problems. Many companies have an asset classification guide and/or a business impact reference to help formalize what is important to their business. These standards can help you focus on what's truly important for security. If these aren't available, then it is necessary to talk with people who understand the business to get their take on what's important. The factors below are common areas for many businesses, but this area is even more unique to a company than the factors related to threat agent, vulnerability, and technical impact.

Since:

1.0.0

Author:

Steve Springett

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
static class	BusinessImpactFactor.FinancialDamage How much financial damage will result from an exploit?
static class	BusinessImpactFactor.NonCompliance How much exposure does non-compliance introduce?
static class	BusinessImpactFactor.PrivacyViolation How much personally identifiable information could be disclosed?
static class	BusinessImpactFactor.ReputationDamage Would an exploit result in reputation damage that would harm the business?

Method Summary

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait