1. A method for assessing and quantifying a risk exposure of at least one information system asset of an entity using a one-dimensional quantitative risk assessment model, comprising: establishing a numerical value for at least one threat of attack on the information system asset of the entity based on expert knowledge without reference to actuarial data; establishing a numerical value for each of at least one access component and at least one privilege component of at least one vulnerability to attack on the information system asset likewise based on expert knowledge without reference to actuarial data; and computing a security risk level for the information system asset based on the numerical value for the threat of attack on the information system asset and the numerical values for the access and privilege components of the vulnerability to attack on the information system asset, wherein computing the security risk level further comprises: calculating the security risk level for the information system asset as a product of the numerical value of the threat of attack on the information system asset and the numerical values for the access and privilege components of the vulnerability to attack on the information system asset, and establishing a monetary value of a financial impact on the entity of attack on the information system asset by a self-assessment of the criticality of confidentiality, integrity and availability of the information system asset to the entity and calculating a financial value of a security risk to the entity from attack on the information system asset based on the financial impact on the entity and the security risk level calculated for the information system, wherein computing the security risk level further comprises establishing a numerical value for a security risk level threshold limit for the information system asset and initiating remediation if the security risk level calculated for the information system asset exceeds the security risk level threshold limit, and wherein initiating remediation further comprises establishing a time limit for initiating remediation and initiating remediation within the time limit if the security risk level calculated for the information system asset exceeds the security risk level threshold limit.
1. A method for assessing and quantifying a risk exposure of at least one information system asset of an entity using a one-dimensional quantitative risk assessment model, comprising: establishing a numerical value for at least one threat of attack on the information system asset of the entity based on expert knowledge without reference to actuarial data; establishing a numerical value for each of at least one access component and at least one privilege component of at least one vulnerability to attack on the information system asset likewise based on expert knowledge without reference to actuarial data; and computing a security risk level for the information system asset based on the numerical value for the threat of attack on the information system asset and the numerical values for the access and privilege components of the vulnerability to attack on the information system asset, wherein computing the security risk level further comprises: calculating the security risk level for the information system asset as a product of the numerical value of the threat of attack on the information system asset and the numerical values for the access and privilege components of the vulnerability to attack on the information system asset, and establishing a monetary value of a financial impact on the entity of attack on the information system asset by a self-assessment of the criticality of confidentiality, integrity and availability of the information system asset to the entity and calculating a financial value of a security risk to the entity from attack on the information system asset based on the financial impact on the entity and the security risk level calculated for the information system, wherein computing the security risk level further comprises establishing a numerical value for a security risk level threshold limit for the information system asset and initiating remediation if the security risk level calculated for the information system asset exceeds the security risk level threshold limit, and wherein initiating remediation further comprises establishing a time limit for initiating remediation and initiating remediation within the time limit if the security risk level calculated for the information system asset exceeds the security risk level threshold limit. 10. The method of claim 1 , wherein establishing the numerical value for the privilege component of the vulnerability to attack further comprises identifying at least one unauthorized privilege that can be acquired by a threat agent from attack on the information system asset.