A computer-implemented method and system for assessing the overall risk in at
least
part of an information technology system includes inputting into a risk assessment
database a plurality of identified risks in a system; associating the risks to
at least one severity band in a risk echelon; assigning a value to each risk; multiplying
each risk value by a coefficient factor; and summing the factored risk values to
determine the overall risk. The method preferably includes modifying the security
implementation of the information technology system and determining the modified
overall risk. The system preferably includes an automated vulnerability detection
scanner to gather risk information, which is stored on a database and used in calculating
the overall risk.
