moodLearning Wiki

SimpleRisk is an open-source risk management system released under Mozilla Public License and used for risk management activities.[(“BlackHat USA 2014,” https://www.blackhat.com/us-14/arsenal.html#Sokol)] It enables risk managers to account for risks, plan mitigation measures, facilitate management reviews, prioritize for project planning, and track periodic reviews. SimpleRisk allows risk managers to prioritize enterprise responses according to the severity of threats and vulnerabilities that could impact the business.[(“toolsmith: SimpleRisk - Enterprise Risk Management Simplified,” http://holisticinfosec.blogspot.com/2014/02/toolsmith-simplerisk-enterprise-risk.html)]

SimpleRisk sports a dashboard for submitting a new risk for consideration by your team, for creating risk reports and graphs of risk levels and locations.[(“Simplerisk Enterprise Risk Management Platform,” http://www.sectechno.com/simplerisk-enterprise-risk-management-platform/ )] Highly configurable, SimpleRisk report generation is dynamic; risk formulas could be tweaked on the fly.[(“SimpleRisk: Enterprise Risk Management Simplified,” http://www.sans.org/reading-room/whitepapers/riskmanagement/risky-business-35287)]

Overview

SimpleRisk was borne out of the need to have an inexpensive system to deal with enterprise risks, including application and physical threats and vulnerabilities, malwares. To manage risks, the choice of tools for risk managers has almost always been between expensive GRC (governance, risk management, and compliance) software and cumbersome, time consuming spreadsheets.[(History, https://www.simplerisk.it/history)] Using a LAMP (Linux, Apache, MySQL, PHP) stack, Josh Sokol developed SimpleRisk based on some simplifications of the NIST 800-30 risk management framework.[(“Enterprise Risk Management for the Masses,” http://www.webadminblog.com/index.php/2013/09/15/enterprise-risk-management-for-the-masses/ )]

Hackers Mail lists SimpleRisk as one of “the best open source risk assessment tools.”[(“List of Best / Open Source Risk Assessment / Analysis Tool,” http://hackersmail.com/index.php/2015/09/18/list-of-best-open-source-risk-assessment-analysis-tool/ )]

Reviews

* Robert Sorensen, “ SimpleRisk: Enterprise Risk Management Simplified,” The SANS Institute, 2014.

See Also

* mL Risk Management System

~~REFNOTES~~