moodLearning Wiki

This is an old revision of the document!


SimpleRisk is an open-source risk management system released under mozilla-public-license and used for risk-management activities.<ref>url = https://www.blackhat.com/us-14/arsenal.html#Sokol |title = BlackHat USA 2014 |accessdate = 15 March 2016|publisher = Black Hat</ref> It enables risk managers to account for risks, plan mitigation measures, facilitate management reviews, prioritize for project planning, and track periodic reviews. 'SimpleRisk' allows risk managers to prioritize enterprise responses according to the severity of threats and vulnerabilities that could impact the business.<ref>url = http://holisticinfosec.blogspot.com/2014/02/toolsmith-simplerisk-enterprise-risk.html |title = toolsmith: SimpleRisk - Enterprise Risk Management Simplified |accessdate = 15 March 2016|publisher = HolisticInfoSec</ref>

'SimpleRisk' sports a dashboard for submitting a new risk for consideration by your team, for creating risk reports and graphs of risk levels and locations.<ref>url = http://www.sectechno.com/simplerisk-enterprise-risk-management-platform/ |title = Simplerisk Enterprise Risk Management Platform |accessdate = 16 March 2016|publisher = HolisticInfoSec</ref> Highly configurable, SimpleRisk report generation is dynamic; risk formulas could be tweaked on the fly.<ref>url = http://www.sans.org/reading-room/whitepapers/riskmanagement/risky-business-35287 |title = SimpleRisk: Enterprise Risk Management Simplified |accessdate = 17 March 2016|publisher = SANS</ref>

Overview

'SimpleRisk' was borne out of the need to have an inexpensive system to deal with enterprise risks, including application and physical threats and vulnerabilities, malwares. To manage risks, the choice of tools for risk managers has almost always been between expensive GRC (governance-risk-management-and-compliance) software and cumbersome, time consuming spreadsheets.<ref>url = https://www.simplerisk.it/history |title = History |accessdate = 15 March 2016|publisher = SimpleRisk</ref> Using a LAMP (Linux, Apache, MySQL, PHP) stack, Josh Sokol developed 'SimpleRisk' based on some simplifications of the NIST 800-30 risk management framework.<ref>url = http://www.webadminblog.com/index.php/2013/09/15/enterprise-risk-management-for-the-masses/|title = Enterprise Risk Management for the Masses |accessdate = 16 March 2016|publisher = SecTechno</ref>

Hackers Mail lists 'SimpleRisk' as one of “the best open source risk assessment tools.”<ref>url = http://hackersmail.com/index.php/2015/09/18/list-of-best-open-source-risk-assessment-analysis-tool/ |title = List of Best / Open Source Risk Assessment / Analysis Tool|accessdate = 15 March 2016|publisher = Hackers Maildate=August 2017</ref>

Reviews

* Robert Sorensen, “ SimpleRisk: Enterprise Risk Management Simplified,” The SANS Institute, 2014.