It's not often that I will read back through every post archived on a blog, but I must tell you that I have found kindred spirits (even if they don't know it) in Alex and Jack's RiskAnalys.is blog. Fantastic stuff. The work they have done bringing FAIR (Factor Analysis of Information Risk) to the world at large is awesome.
Something I'd like to do is relate FAIR to OCTAVE which I have used to feed SRM systems like Skybox (because I'm obviously not busy enough...)
I'm not usually at a loss for words, but these guys really, really have an amazing grasp of the realities, vagaries and challenges of assessing, communicating and managing risk.
Please do yourself a favor and read/subscribe to their blog and better yet, check out FAIR and Risk Management Insight's (RMI) website.
Really great stuff.