I may be overreaching but I include risk analysis as a proper subject of systems analysis. I've done enough TRAs to justify that position—at least to myself. So here's a risk analysis topic.
Toying with the idea of getting some certification I took a look at the CISSP and ISC Common Body of Knowledge. One thing I found odd enough to exchange a few emails with ITSec gurus. They assured me that this was the state of the discipline. The offense lay in a particular statement, repeated in various documents:
Purely quantitative risk analysis is not possible because the method is attempting to quantify qualitative items.
That, in the words of Dr. Pauli, is not even wrong; "Nothing that matters is so intangible that it can't be measured," is almost a tautology.
If it matters, it has an effect. Observing that effect is measuring it. Drawing a distinction between its presence or absence is measuring it. Estimating a range of values or probability distribution for it is measuring it.
This isn't unimportant. No one can do a cost/benefit analysis that tells them how much they should spend mitigating a "medium-high risk". The effect is that a lot of people are overspending on security based on a "let's scare the pants off them" qualitative risk assessment.
Bottom line: one of an analyst's skills should be measuring the putatively immeasurable.
Any challenges?