A Guided Tour of the CORAS Method

This chapter presents a guided tour of the CORAS method. As illustrated by Fig. 3.1, the CORAS method is divided into eight steps. The first four of these steps are introductory in the sense that we use them to establish a common understanding of the target of the analysis, and to make the target description that will serve as a basis for the subsequent risk identification. The introductory steps include documenting all assumptions about the environment or setting in which the target is supposed to work, as well as making a complete list of constraints regarding which aspects of the target should receive special attention, which aspects can be ignored, and so forth. The remaining four steps are devoted to the actual detailed analysis. This includes identifying concrete risks and their risk level as well as identifying and assessing potential treatments for unacceptable risks. In the following sections, we go through each of the eight steps of the CORAS method by means of a running example from the telemedicine domain. We follow two analysts in their interaction with an organisation by which they have been hired to carry out a risk analysis. They conduct the analysis according to the eight steps of the CORAS method.