A Hybrid Approach
Usually, most enterprises do not pick and choose a specific risk management approach since asset-based risk management and threat-based risk management both have their pros and cons. The asset-based risk management is a more traditional method of risk management, and crafting metrics from these methods would need a strong asset inventory setup. This is usually a long process and has multiple recurring cycles to enrich. Depending on asset inventory alone would greatly impact the crafting of metrics and its timelines. Threat-based risk management is faster and more effective when it comes to context-based evaluations. An enterprise would usually begin asset inventory and start identifying key assets. As each asset is identified, threat flow scenario–based risk management is performed, and over time the metric gets crafted or influenced by the threat flows identified for each type of asset. At this stage, during strategic and architectural discussions, the main goal is to spend time and effort to align and craft critical metrics that satisfy and resonate with all stakeholders.