CYS403 - Chapter 5: Risk Assessment Approaches

01 / Purpose

What Risk Assessment Is and Why It Matters

Risk assessment (RA) is performed to identify the most serious risks. There are two primary methods:

Quantitative

Calculates monetary values with predefined formulas.

Qualitative

Uses values or words assigned to the probability of a risk occurring and its impact if it occurs.

Importance of risk assessment

RAs are an important part of the risk management process.
Without an RA, it is difficult to determine which systems should be protected, and unclear how to protect them.
An RA identifies the most important systems to protect.
It gives insight into which controls will provide the most value.

After identifying threats, vulnerabilities, and asset value, you need the likelihood and impact of each threat on the assets, then prioritize the risks to know which must be treated first.

02 / Timing

When to Conduct a Risk Assessment

Risk assessment is a continuous process. It should be conducted:

When evaluating risk in the SDLC

At project initiation, company startup, and similar starting points.

When evaluating a security control

During periodic monitoring.

After a control is implemented

To ensure its suitability and functionality.

Not a one-time event

An RA done once and filed away quickly becomes outdated. Assets, threats, and controls change, so the assessment must be repeated.

03 / Components

Critical Components: Scope, Critical Areas, Team

[1] Scope

Identifies the boundary of the RA: what is included and what is not. It helps keep the RA on track.

[2] Critical areas

Identifies the critical areas that should be included, helping the RA team focus only on what's important.

[3] Team

RA team personnel should not be the same people responsible for correcting deficiencies, to avoid a conflict of interest. But input from the responsible people is very important.

Critical areas example

In-scope system	Critical area to focus on
Web server	Single point of failure (SPOF); OS update/patch status
Database server	Only the data exchanged with the web server
Firewall	Inspection of all traffic

Memory trick · S-C-T

Scope, Critical areas, Team

where the boundary is, what matters inside it, and who is independent enough to judge it.

04 / Quantitative

Quantitative Risk Assessment

Quantitative assessment is an objective method. It uses numbers such as actual dollar values, requires a significant amount of data that takes a long time to gather, and is essentially a simple math problem using formulas.

Term	Meaning	Example from the slides
SLE Single loss expectancy	Total loss expected from a single incident (when a threat exploits a vulnerability); includes hardware, software, and data.	$5,000
ARO Annual rate of occurrence	Number of times an incident is expected per year.	Once a month → ARO = 12
ALE Annual loss expectancy	Expected loss for a year = SLE × ARO (a dollar value).	$5,000 × 12 = $60,000
Safeguard value	The cost of a control used to mitigate risk.	$50 anti-virus × 100 computers = $5,000

FormulaALE = SLE × AROSavings with control = ALE(before) − ALE(after) − Control cost

Benefits and limitations

Benefits

Mathematical calculation with accurate, objective results; verifiable facts without debate; can be automated (e.g. Excel).

Limitations

Accurate data isn't always available; hard to ensure people use the control as expected.

05 / Class Activity

Worked Example: Stolen Laptops

A company issues laptops worth $2,000 each (hardware, software, and data). About 100 laptops are in use. Over the past two years the company lost one laptop per quarter, stolen when left unattended.

Question	Answer	Why
SLE?	$2,000	One stolen laptop loses its full value.
ARO?	4	One per quarter = 4 per year.
ALE?	$8,000	$2,000 × 4.

Should the company buy hardware locks?

Locks cost $10 each, so the safeguard value is $10 × 100 = $1,000. With locks, the ARO is expected to drop from 4 to 1.

Current ALE (before the control)

$2,000 × 4 = $8,000

ARO with the control

ALE with the control (after)

$2,000 × 1 = $2,000

Savings with the control

$8,000 − $2,000 − $1,000 = $5,000

Decision

Savings are positive ($5,000), so yes, buy the locks: they cost $1,000 a year but cut expected losses by $6,000.

06 / Qualitative

Qualitative Risk Assessment

Qualitative assessment is a subjective method. It uses relative values based on expert opinion. Experts give their input on the probability and impact of a risk, so a qualitative RA can be completed rather quickly.

Probability

The likelihood that a threat will exploit a vulnerability. Rated with word values (Low, Medium, High) or percentages (e.g. 10% = low, 100% = high).

Impact

The negative result if a risk occurs; identifies the magnitude of a risk (amount of loss). Rated with the same kind of word or percentage scale.

FormulaRisk level = Probability × Impact

Slide 26Probability versus impact matrix.

Slide 27Qualitative survey results: risk level = probability x impact.

Putting it together

Each risk is plotted on a probability × impact matrix, and the results are written up in a risk assessment report listing risks from highest to lowest level.

07 / Formula

Risk Determination Formula

For relative risk assessment, risk equals the likelihood of vulnerability occurrence times value (or impact), minus the percentage of risk already controlled, plus an element of uncertainty.

FormulaRisk = (Likelihood × Value) − (% controlled × Likelihood × Value) + (% uncertainty × Likelihood × Value)

Likelihood

The probability that a specific vulnerability will be the object of a successful attack.
Assign a number between 0.1 (low) and 1.0 (high), or between 1 and 100 (%).
Zero is not used: vulnerabilities with zero likelihood are removed from the asset/vulnerability list.

Uncertainty

If data is 90% accurate, uncertainty = 1 − 0.9 = 10%. If 80% accurate, uncertainty = 20%.

Worked examples from the slides

Case	Inputs	Calculation	Risk
Asset A, vulnerability 1	Value 50, likelihood 1.0, 0% controlled, 90% accurate (10% uncertainty)	(50×1.0) − 0 + 10%(50) = 50 − 0 + 5	55
Asset B, vulnerability 2	Value 100, likelihood 0.5, 50% controlled, 80% accurate (20% uncertainty)	(100×0.5) − 50%(50) + 20%(50) = 50 − 25 + 10	35
Asset B, vulnerability 3	Value 100, likelihood 0.1, 0% controlled, 80% accurate (20% uncertainty)	(100×0.1) − 0 + 20%(10) = 10 − 0 + 2	12

Memory trick · Compute the base first

BaseLikelihood × Value

Then subtract controlled% of the base and add uncertainty% of the same base.

08 / Results

Documenting the Results

The final summary is comprised in a ranked (vulnerability) risk worksheet.
The ranked risk worksheet is the initial working document for the next step in the risk management process: assessing and controlling risk.

Deliverable	Purpose
Information asset classification worksheet	Assembles information about information assets and their impact.
Weighted criteria analysis worksheet	Assigns a ranked value or impact weight to each information asset.
Ranked vulnerability risk worksheet	Assigns a ranked risk rating for each uncontrolled asset–vulnerability pair.

Slide 37The deliverables of risk identification and what each is for.

Slide 38Where the process stands: identification and assessment done, risk control next.

Using the examples

Ranking the three worked examples gives A/V1 (55) first, B/V2 (35) second, and B/V3 (12) third.

09 / Exam Prep

Exam Tips & Tricks

Two methods

Quantitative = monetary values with formulas (objective). Qualitative = words/values for probability and impact from experts (subjective, quick).

When to assess

Continuously: SDLC/project start, periodic control monitoring, and after a control is implemented.

S-C-T

Scope = boundary; critical areas = focus; team ≠ people who fix deficiencies (conflict of interest).

Core formulas

ALE = SLE × ARO. Savings = ALE before − ALE after − control cost.

Laptop activity

SLE $2,000, ARO 4, ALE $8,000; locks $1,000, ARO → 1, ALE after $2,000; savings $5,000 → buy.

Likelihood scale

0.1–1.0 or 1–100%. Zero is never used; such vulnerabilities are removed.

Risk determination

Risk = L×V − controlled%(L×V) + uncertainty%(L×V). Examples: 55, 35, 12.

Three deliverables

Asset classification worksheet, weighted criteria analysis worksheet, ranked vulnerability risk worksheet.

10 / Self-Test

Flashcards — Test Yourself

Say the answer out loud, then flip the card to check. Shuffle the deck to test yourself in a new order.

11 / Cheat Sheet

Quick Reference — Everything at a Glance

Topic	Key Point
Risk assessment	Performed to identify the most serious risks.
Quantitative RA	Objective; dollar values; lots of data and time; formulas.
Qualitative RA	Subjective; expert opinion on probability and impact; quick.
When to conduct RA	SDLC/project initiation, periodic control monitoring, after control implementation.
Scope	Boundary of the RA: what is and isn't included.
Critical areas	Important parts to focus on (web server SPOF, exchanged data, firewall inspection).
Team	Not the people responsible for fixing deficiencies; avoids conflict of interest.
SLE	Total loss from a single incident.
ARO	Incidents expected per year.
ALE	SLE × ARO.
Safeguard value	Cost of a control (e.g. $50 × 100 computers = $5,000).
Savings with control	ALE before − ALE after − control cost.
Quantitative benefits / limits	Objective, verifiable, automatable / data not always available, control use not guaranteed.
Probability / impact	Likelihood a threat exploits a vulnerability / magnitude of loss.
Risk determination	L × V − % controlled + % uncertainty.
Likelihood values	0.1 to 1.0 or 1 to 100; zero not used.
Ranked risk worksheet	Final summary; starting point for assessing and controlling risk.