What Is Risk?
Risk is the possibility of losing something of value. Put another way, risk is the probability that a threat will turn into a disaster.
A vulnerability (weakness) and a hazard are not dangerous when taken separately. But when they come together, they become a risk: the probability that a disaster will happen.
The NIST SP 800-30 definition
Memorize this definition
Risk is a function of the likelihood of a given threat-source's exercising a particular potential vulnerability, and the resulting impact of that adverse event on the organization's assets. (NIST SP 800-30)
FormulaRisk = Probability (threat, vulnerability, impact)
Key Terms and Concepts
Memory trick · Potential vs actual
- ThreatAttack
- Threat agentAttacker
the first word in each pair is potential, the second is actual.
Examples of threats
| Unauthorized access | Human errors |
| Hardware failure | Neighboring hazards |
| Utility failure | Tampering |
| Loss of key personnel | Dissatisfied employees |
Risk Factors and Residual Risk
Risk exists where three factors overlap: threats, assets, and vulnerabilities. Remove any one of them and there is no risk.
Once safeguards are applied, the overlap shrinks but rarely disappears. What is left is the residual risk, which should be reduced to an acceptable level.
Residual risk is never zero
Controls reduce risk; they do not eliminate it. Management must decide what level of residual risk is acceptable.
Risk Management: Identify, Assess, Control
Organizations must design and create safe environments in which business processes and procedures can function. Risk management is the process of identifying and controlling the risks facing an organization.
Identify, examine, and understand the information and systems currently in place.
Identify, examine, and understand the threats facing the organization.
Managing risk is the responsibility of each community of interest within the organization.
Purpose of risk management
- Identify potential cyber risks before they occur,
- across the life of the product or project,
- so that risk-handling activities may be planned and invoked as needed.
Risk management identifies and reduces risks (threats, vulnerabilities, and impact on asset value). Mitigating controls (safeguards and countermeasures) reduce risk, and residual risk should be set to an acceptable level.
The Three Components of Risk Management
| Risk assessment | Risk mitigation | Evaluation and assurance |
|---|---|---|
| Identification of risks | Risk avoidance | Ongoing risk assessment |
| Evaluation of risks | Risk mitigation | Periodic evaluation |
| Risk impact | Risk acceptance | Regulatory compliance |
| Recommendation of risk-reducing measures | Risk transference | |
| Evaluation of risks |
Read the table top-down
Assessment finds and rates risks; mitigation decides what to do about them; evaluation and assurance keep checking that the decisions still hold.
The Five Risk Management Steps
Identify the risk
Uncover, recognize, and describe risks that might affect the system or its outcomes. Several techniques exist. You start to prepare your Risk Register.
Analyze the risk
Determine the likelihood and impact of each risk and understand its potential to affect business objectives. This is also input to the Risk Register.
Evaluate and rank the risk
Determine the risk score = combination of likelihood and impact. Decide whether the risk is acceptable or serious enough to treat. Rankings go into the Risk Register.
Risk control (risk response planning)
Plan to treat the highest-ranked risks to reach acceptable levels: mitigation strategies, preventive plans, and contingency plans (DRP, BCP, IRP). Treatment measures are added to the Risk Register.
Monitor and review the risk
Use the Risk Register to monitor, track, and review risks.
Memory trick · I-A-E-C-M
I Always Evaluate Carefully, Monthly
Identify, Analyze, Evaluate/rank, Control, Monitor.
The risk register
The Risk Register is started in step 1 and updated in every later step. Step 5 is where you use it to monitor and review.
Automated tools for risk management
- Aim to minimize manual effort.
- Can be time consuming to set up.
- Perform calculations quickly.
Quantitative Risk Analysis
There are two types of risk analysis: quantitative and qualitative. Both provide unique capabilities, and both are often required to get a full picture.
- Assigns independently objective numeric monetary values (RISK = MONEY).
- Is fully quantitative only if all elements of the analysis are quantified.
- Is sometimes difficult to achieve.
- Requires substantial time and personnel resources.
Quantitative analysis steps
Determine asset value (AV)
What the asset is worth to the organization.
Estimate potential losses
The exposure factor (EF): the percentage of value lost in one incident.
Conduct a threat analysis
Probability and impact: how often the threat happens (ARO).
Determine annual loss expectancy (ALE)
The expected yearly loss.
FormulaSLE = Asset Value × Exposure FactorALE = SLE × AROValue of control = ALE(before) − ALE(after) − ACS
Worked example from the slides
A server is worth USD 10,000. If attacked by threat X, EF = 70%. The threat is expected 20 times a year (ARO, a subjective expert estimate).
| Quantity | Calculation | Result |
|---|---|---|
| SLE | 10,000 × 70% | 7,000 |
| ALE | 7,000 × 20 | 140,000 |
| Value of control | 140,000 (ALE before) − 50,000 (ALE after) − 30,000 (annual cost of control) | 60,000 |
Decision rule
If the value of the control is positive, the control saves more than it costs, so it is worth buying.
Qualitative Risk Analysis
- Scenario oriented.
- Does not attempt to assign absolute numeric values to risk components.
- Purely qualitative risk analysis is possible.
Critical factors
- Rank the seriousness of threats and the sensitivity of assets.
- Perform a carefully reasoned risk assessment.
Risk levels: the AS/NZS 4360 matrix
| Likelihood ↓ / Consequence → | 1 Insignificant | 2 Minor | 3 Moderate | 4 Major | 5 Catastrophic |
|---|---|---|---|---|---|
| A (almost certain) | H | H | E | E | E |
| B (likely) | M | H | H | E | E |
| C (possible) | L | M | H | E | E |
| D (unlikely) | L | L | M | H | E |
| E (rare) | L | L | M | H | H |
| Level | Meaning |
|---|---|
| E Extreme | Immediate action required to mitigate the risk, or decide not to proceed. |
| H High | Action should be taken to compensate for the risk. |
| M Moderate | Action should be taken to monitor the risk. |
| L Low | Routine acceptance of the risk. |
Five top qualitative RA techniques
- Delphi technique
- SWIFT analysis (Structured What-If)
- Decision tree analysis
- Bow-tie analysis
- Probability/consequence matrix
Objective, uses money values and formulas, needs lots of data and time, results are verifiable.
Subjective, uses ranks/words from expert judgment, scenario-based, faster, easier to perform.
Risk Mitigation Options
Memory trick · A-R-T-A
Ask: is it cheaper to live with it, fix it, pass it on, or stop doing it?
The right amount of security
Use cost/benefit analysis (CBA): balance the cost to protect against the asset value. Security is a balancing act. Before a CBA you must understand:
- The adversary: means, motives, and opportunity
- Asset value (more than just cost)
- Threat analysis
- Vulnerability analysis
- The resulting risk
- Countermeasures
- Risk tolerance and risk appetite
Countermeasure Selection Principles
| Principle | Meaning |
|---|---|
| Cost/benefit analysis | Cost must be justified by the potential loss. |
| Accountability | Someone is clearly responsible for the safeguard. |
| Absence of design secrecy | Security does not rely on a secret design: safeguards are changeable, interoperable, and trusted (Common Criteria evaluation). |
| Audit capability | The safeguard can be tested and audited. |
| Vendor trustworthiness | The supplier is reliable. |
| Independence of control and subject | Segregation of duties: those controlled don't control the safeguard. |
| Universal application | Applies to everyone equally. |
| Compartmentalization and defense in depth | Layered protection limits damage. |
| Isolation, economy, least common mechanism | Isolate critical parts, keep it simple, minimize shared mechanisms. |
| Acceptance and tolerance by personnel | Users must accept it or they will bypass it. |
| Minimum human intervention | Less manual effort, fewer errors. |
| Sustainability | Can be maintained over time. |
| Reaction and recovery | Supports responding to and recovering from incidents. |
| Override and fail-safe defaults | Fails into a secure state; overrides are controlled. |
| Residuals and reset | Clears residual data and returns to a known state. |
Types of Security Controls
| Control type | Purpose | Example |
|---|---|---|
| Directive (administrative) | Advise employees of the behavior expected of them when using information systems. | Acceptable use policy |
| Preventive | Physical, administrative, and technical measures to prevent actions violating policy or increasing risk. | Locks, firewalls, access control |
| Detective | Practices, processes, and tools that identify and possibly react to security violations. | IDS, audit logs, CCTV |
| Corrective | React to a detected incident to reduce or eliminate the chance of the unwanted event recurring. | Patching, removing malware |
| Recovery | Restore the system or operation to a normal state after integrity or availability is compromised. | Restoring backups, DRP |
Memory trick · Before, during, after
Do Please Detect, Correct, Recover
tell people (Directive), stop it (Preventive), find it (Detective), fix it (Corrective), get back to normal (Recovery).
Exam Tips & Tricks
NIST SP 800-30 risk
Risk is a function of the likelihood of a threat-source exercising a vulnerability and the resulting impact on assets.
Threat vs attack
Threat = potential danger; attack = actual danger. Threat agent = potential cause; attacker = actual cause.
Residual risk
The risk remaining after safeguards are applied. Set it to an acceptable level; it is never zero.
Five steps
Identify → Analyze → Evaluate and rank → Control (DRP, BCP, IRP) → Monitor and review. The Risk Register starts at step 1.
Formulas
SLE = AV × EF. ALE = SLE × ARO. Control value = ALE before − ALE after − annual cost of control.
Slide example
Server USD 10,000, EF 70% → SLE 7,000; ARO 20 → ALE 140,000; control value = 140,000 − 50,000 − 30,000 = 60,000.
Matrix levels
E = immediate action or don't proceed; H = compensate; M = monitor; L = routine acceptance.
A-R-T-A
Accept (control costs more than loss), Reduce (countermeasure), Transfer (third party), Avoid (stop the activity).
Flashcards — Test Yourself
Say the answer out loud, then flip the card to check. Shuffle the deck to test yourself in a new order.
Quick Reference — Everything at a Glance
| Topic | Key Point |
|---|---|
| Risk | Possibility of losing something of value; probability a threat becomes a disaster. |
| Risk (NIST SP 800-30) | Likelihood of a threat-source exercising a vulnerability × resulting impact on assets. |
| Asset | Something valued by the organization to accomplish its goals. |
| Threat / attack | Potential danger / actual danger. |
| Threat agent / attacker | Potential cause of a threat / actual cause of an attack. |
| Vulnerability | Any weakness that could be exploited. |
| Exposure | An opportunity for a threat to cause loss. |
| Residual risk | Risk remaining after countermeasures are applied. |
| Risk identification / assessment / control | Examine current security / evaluate risks to find controls / apply controls. |
| Risk management steps | Identify, analyze, evaluate and rank, control, monitor and review. |
| Risk score | Combination of likelihood and impact. |
| Quantitative analysis | Objective monetary values; fully quantitative only if all elements quantified; costly. |
| SLE / ALE | AV × EF / SLE × ARO. |
| Qualitative analysis | Scenario oriented; no absolute numbers; ranks seriousness of threats and asset sensitivity. |
| AS/NZS 4360 | Likelihood (A–E) × consequence (1–5) → Extreme, High, Moderate, Low. |
| Qualitative techniques | Delphi, SWIFT, decision tree, bow-tie, probability/consequence matrix. |
| Mitigation options | Acceptance, reduction, transference, avoidance. |
| Control types | Directive, preventive, detective, corrective, recovery. |