Open FAIR™: Quantitative Risk Analysis and Updates to the Standard
Channel: The Open Group
Date: 28/07/2020

What is Open FAIR™? Factor Analysis of Information Risk

The Open FAIR Body of Knowledge comprised of The Open Group Risk Taxonomy (O-RT) Standard & The Open Group Risk Analysis (O-RA) Standard.

Why use Open FAIR™?
- Framework and taxonomy for understanding, analyzing, and measuring information risk.
- Risk is the probable frequency and probable magnitude of future loss.
- Organizations can discuss risk consistently.

(4:23) - Risk Management Stack
(6:48) - The Open FAIR™ Risk Taxonomy - Utilize a top-down approach. Analyze with objective data, not subjective information. Document rationale & assumptions.
(14:56) - Adding the NIST CSF Five Functions
(16:42) - Adding Rigor to the Standard

The Open Group Open FAIR™ Certification Program is aimed at meeting the needs of risk analysts and organizations employing risk analysts. The program is based upon Open Factor Analysis of Information Risk (FAIR), an open and independent information risk analysis methodology. See some of the Open FAIR Guides we have available to download within The Open Group Library: https://publications.opengroup.org/guides/open-fair

What is Open FAIR™? https://www.opengroup.org/certifications/openfair

Speaker: John Linford is the Forum Director of The Open Group Security Forum and Open Trusted Technology Forum. Prior to joining The Open Group in June 2019, John worked as a Lecturer for San Jose State University, teaching courses in Economics. John is Open FAIR™ certified and was the lead author of the Open FAIR Risk Analysis Process Guide (G180), which offers best practices for performing an Open FAIR Risk Analysis with an intent to help risk analysts understand how to apply the Open FAIR risk analysis methodology. 

Speaker: Eva Kuiper, M.S., CISA, CISSP, CISSP-ISSAP, has over twenty years of experience in information security, with a focus on governance, risk, and compliance and security program development. She spent ten years as a member of a Fortune 50 internal information security team working on security strategy and architecture as well as risk, and compliance activities including mergers and acquisitions security and vendor risk management.