Risk Assessment Approaches

• CLO 2: Synthesize the principles of cyber security risk management and a framework of components: identification, protection, detection, response and recovery.
• CLO 3: Develop a working knowledge of types of policy, how policy is created, how to implement and manage policy, measurement practices, and audit of policy

• Check LMS

• Quiz will be next Sunday 13/09/2026

• Risk assessment: Quantitative OR Qualitative

• Risk assessment is performed to identify the most serious risks.
• There are two primary methods used to create a risk assessment,
  • Quantitative: calculating the monetary values with predefined formulas.
  • Qualitative: uses values/words assigned to the probability of a risk occurring and the impact of a risk if it occurs.

• Risk assessments are an important part of the risk management process.
• Without an RA, it becomes difficult to determine which systems should be protected.
• It also remains unclear how to protect them. However, an RA will help you identify the most important systems to protect.
• It will also give you insight into what controls will provide the most value.

• RA is a continuous process.
• RA should be conducted
  • When evaluating risk in SDLC, Project initiation, startup time of company, etc.
  • When evaluating a security control: during the periodic monitoring.
  • After control implemented: to ensure its suitability and functionality.

[1]. Scope.

[2]. Critical areas [3]. Team

[2]. critical areas: The RA also identifies critical areas that should be included.

• For example, a scope could include a Web server, a database server, and a firewall.
  • Web server: SPOF, OS update batch,
  • Database server: only data that are exchanged with webserver.
  • Firewall: inspecting all the traffic
• This helps the RA team focus only on what’s important.

[3]. Team: RA team personnel should not be the same people who are responsible for correcting deficiencies.

• This helps avoid a conflict of interest.
• But, the input from the responsible people is very important.

• Qualitative — This is a subjective method.
  • It uses relative values based on opinions from experts.
  • Experts provide their input on the probability and impact of a risk. A qualitative RA can be completed rather quickly.

• Some of the key terms associated with quantitative risk assessments are:
  • Single loss expectancy (SLE) — The total loss expected from a single incident.
    • An incident occurs when a threat exploits a vulnerability. The loss is expressed as a dollar value such as $5,000. It includes the value of hardware, software, and data.
  • Annual rate of occurrence (ARO) — The number of times an incident is expected to occur in a year.
    • If an incident occurred once a month in the past year, the ARO is 12. Assuming nothing changes, it’s likely that it will occur 12 times next year.

• Some of the key terms associated with quantitative risk assessments are:
  • Annual loss expectancy (ALE) — The expected loss for a year. ALE is calculated
    • by multiplying SLE X ARO. Because SLE is a given in a dollar value, ALE is given as a dollar value. For example, if the SLE is $5,000 and the ARO is 12, the ALE is $60,000.
  • Safeguard value — This is the cost of a control. Controls are used to mitigate risk.
    • For example, antivirus software could have an average cost of $50 for each computer. If you have 100 computers, the safeguard value is $5,000.

• Consider this scenario: A company issues laptop computers to employees. The value of each laptop is $2,000. This includes the hardware, software, and data. About 100 laptops are being used at any time. In the past two years, the company has lost an average of one laptop per quarter. These laptops were stolen when systems were left unattended.

With this information, can you answer these questions?

• What’s the SLE? ($2000)
• What’s the ARO? (4)
• What’s the ALE? ($8000)

• The company could purchase hardware locks for the laptops in bulk at a cost of $10 each. The safeguard value is $10 * 100 laptops, or $1,000. It’s estimated that if the locks are purchased, the ARO will decrease from 4 to 1. Should the company purchase these locks?
  • SLE?
  • ARO?
  • ALE?
  • Control cost?

• The company could purchase hardware locks for the laptops in bulk at a cost of $10 each. The safeguard value is $10 * 100 laptops, or $1,000. It’s estimated that if the locks are purchased, the ARO will decrease from 4 to 1. Should the company purchase these locks?
  • SLE=$2000
  • ARO=1*4=4
  • ALE= 2000*4=8000
  • Control cost= 1000

• The company could purchase hardware locks for the laptops in bulk at a cost of $10 each. The safeguard value is $10 * 100 laptops, or $1,000. It’s estimated that if the locks are purchased, the ARO will decrease from 4 to 1. Should the company purchase these locks?
  • Current ALE =$8,000 (ARO of 4 * $2,000) (before the control)
  • ARO with control =1
  • ALE with control = $2,000 (ARO of 1 * $2,000) (after the control)
  • Savings with control = ALE(before) – ALE (after)- Control Cost = 8000-2000- 1000=5000.

• Benefits:
  • Mathematical calculation with accurate objective results.
  • Verifiable facts without debate.
  • Can be automated (e.g. excel sheet).
• Limitations:
  • accurate data isn’t always available.
  • Hard to ensure that people use the control as expected

• it determines the level of risk based on the probability and impact of a risk (Experts opinions).
  • Probability — The likelihood that a threat will exploit a vulnerability.
    • The risk occurs when a threat exploits a vulnerability.
    • A scale can be used to define the probability that a risk will occur.
      • word values such as Low, Medium, or High.
      • percentage values to these words. (e.g. 10% means low, 100% high)
  • Impact — The negative result if a risk occurs. Impact is used to identify the magnitude of a risk (amount of loss).
    • word values such as Low, Medium, or High.
    • percentage values to these words. (e.g. 10% means low, 100% high)

Risk Determination

• For the purpose of relative risk assessment:
  • Risk EQUALS
  • Likelihood of vulnerability occurrence
  • TIMES value (or impact)
  • MINUS percentage risk already controlled
  • PLUS an element of uncertainty

Risk = likelihood x value (impact) - %risk already controlled + element of uncertainty

Likelihood

• Likelihood is the probability that a specific vulnerability will be the object of a successful attack
• Assign numeric value:
  • number between 0.1 (low) and 1.0 (high), or a number between 1 and 100 (%)
• Zero not used since vulnerabilities with zero likelihood are removed from asset/vulnerability list

• Information Asset A
  • Value score (or impact) = 50
  • Has 1 vulnerability with likelihood of 1.0 and no current controls
  • Our assumptions and data are 90% accurate
• Information Asset B
  • Value score (or impact) = 100
  • Has 2 vulnerabilities
    • Vulnerability 2 with likelihood of 0.5 and current controls addressing 50% of its risk
    • Vulnerability 3 with likelihood of 0.1 and no current controls addressing 50% of its risk
  • Our assumptions and data are 80% accurate

Example (1)

• Information Asset A
  • Asset value=50
  • Has 1 vulnerability
    • Likelihood =1.0
    • no current controls
    • 90% accurate uncertainty =1-0.9=0.1 or 10% →

Risk = (50 x 1.0) – 0% x (50 x 1.0) + 10% (50 x 1.0)

= 50 – 0 + 5 = 55

Documenting the Results of Risk

Assessment

• Final summary comprised in ranked risk worksheet
• Ranked risk worksheet is initial working document for next step in risk management process: assessing and controlling risk

Ranked Risk Worksheet