Abstract :
According to conventional wisdom, information security management must start with a quantitative risk analysis. Such an analysis works fine in theory, but it hardly works in practice. Baseline requirements, vulnerability management, and qualitative risk analysis can combine to provide a viable alternative.
