It Security: Risk Analysis Terms & Definitions

Front 1

Define "RISK"

Back 1

Possibility of harm to an asset as a result of a threat exploiting a vulnerability.

Ex. Probability of a virus entering your organization and infecting your computers causing damage.

RISK = THREAT x VULNERABILITY X IMPACT

Front 2

Define an "ASSET"

Back 2

Valuable resource you are trying to protect

(Ex. Data, Systems, People, Buildings, Property,...)

Front 3

Define a "THREAT"

Back 3

A potentially harmful occurrence

Potential danger to an asset carried out by a threat agent

Ex. earthquake, power outage, network based worm (Conficker)

Front 4

Define "VULNERABILITY"

Back 4

Weakness that allows a threat to cause harm.

Ex. buildings not built to withstand earthquakes, a DC without proper backup power, an old and unpatched system.

Front 5

Define "IMPACT / COST (Consequences)"

Back 5

Severity of the damage, sometimes expressed in dollars and therefore can appear as Cost for that reason.

Front 6

Define a "SAFEGUARD"

Back 6

A measure taken to reduce a risk

Front 7

Define "ANNUALIZED LOSS EXPECTANCY (ALE)"

Back 7

Calculation that allows you to determine the annual cost of a loss due to a risk.

(Once calculated, ALE allows you to make informed decisions to mitigate the risk.)

ALE = SLE X ARO

Front 8

Define "ASSET VALUE (AV)"

Back 8

Value of the IN/TANGIBLE asset you are trying to protect.

Front 9

Define an "INTANGIBLE ASSET"

Back 9

Value of an asset that is challenging to calculate / has no direct price tag.

Ex. Brand Loyalty

Front 10

Define a "TANGIBLE ASSET"

Back 10

Value of an asset that are straightforward to calculate.

Ex. Computers, Buildings

Front 11

Define "EXPOSURE FACTOR (EF)"

Back 11

percentage (%) of value an asset has lost due to an incident.

Ex. loss of an unecrypted laptop = 100% EF

Front 12

Define "SINGLE LOSS EXPECTANCY (SLE)"

Back 12

Cost of a single Loss.

SLE = AV X EF

, where AV=Asset Value and EF=Exposure Factor

Front 13

Define "ANNUAL RATE OF OCCURENCE (ARO)"

Back 13

Number of losses you suffer per year

Ex. lost 11 laptops per year on average, ARO=11

Front 14

Define "TOTAL COST OF OWNERSHIP (TCO)"

Back 14

Cost of a mitigating safeguard.

It combines upfront costs (often a one-time capital expense) plus annual cost of maintenance, including staff hours, vendor maintenance fees, software subscriptions, etc..

Front 15

Define "RETURN ON INVESTMENT (ROI)"

Back 15

Amount of money saved by implementing a safeguard.

If your TCO is less than your ALE (TCO <ALE), you have a Positive ROI (and have made a good choice)
If your TCO is higher than your ALE (TCO>ALE), you have a negative ROI (and made a poor choice)

Front 16

LIST THE TYPES OF RISK ANALYSIS

Back 16

- QUALITATIVE
- QUANTITATIVE
- HYBRID

Front 17

Define "QUALITATIVE RISK ANALYSIS"

Back 17

Uses simple and approximate values and is inherently subjective.

Ex. Risk Analysis Matrix

Front 18

Define "QUANTITATIVE RISK ANALYSIS"

Back 18

Uses hard metrics (dollars, hours,...) and is more objective than Qualitative Risk Analysis.

You are required to CALCULATE the quantity of the asset you are protecting.

Front 19

Define "HYBRID RISK ANALYSIS"

Back 19

Combines Qualitative and Quantitative Risk Analysis.

Uses Quantitative analysis for risks that may easily be expressed in hard numbers (dollars), and the Qualitative for the remaining risks.

Front 20

Define "RISK METRICS"

Back 20

Metrics that can greatly assist the Information Security budgeting process.

They help illustrate potentially costly risks and demonstrate the effectiveness (and potential cost savings) of existing controls.

Front 21

WHAT CHOICES DO WE HAVE WHEN CONFRONTING RISK?

Back 21

After a Risk has been assessed, we can choose to:

1) ACCEPT THE RISK
2) MITIGATE THE RISK
3) TRANSFER THE RISK
4) AVOID THE RISK

Front 22

Define "ACCEPTING RISK"

Back 22

After a thorough Risk Analysis where all options were considered, it is determined that it is cheaper to leave an asset unprotected relative to a specific risk, rather than spend the effort and money required to protect it.

Front 23

What are the typical criteria for ACCEPTING A RISK

Back 23

LOW LIKELIHOOD/CONSEQUENCE risks are the typical candidates for Risk Acceptance.

Some risks (such as data protected by law, or life/safety of employees) however are examples where risk acceptance in NOT an option.

Front 24

Define "MITIGATING A RISK"

Back 24

Lowering a Risk to an acceptable level.

Ex. Loss of Laptops with PII, Mitigating the risk could be to encrypt the laptops.

Front 25

Define "TRANSFER THE RISK"

Back 25

AKA ,Insurance Model. You pay an Insurance Company to assume the Risk for you.

Ex. Fire Insurance

Front 26

Define "AVOID THE RISK"

Back 26

After a thorough Risk Analysis it is determined that there are HIGH or EXTREME Risks that cannot be easily mitigated, and that avoiding the risk is the best option.

If ALE > ROI (despite risk mitigation) then AVOID

Legal or Regulatory enforcement may also prevent you from chosing anything other than Avoiding risk.

Front 27

List the 9 steps in NIST's RISK MANAGMENT PROCESS entitled "Managment Guide for IT Systems"

Back 27

1. SYSTEM CHARACTERIZATION
2. THREAT IDENTIFICATION
3. VULNERABILITY IDENTIFICATION
4. CONTROL ANALYSIS
5. LIKELIHOOD DETERMINATION
6. IMPACT ANALYSIS
7. RISK DETERMINATION
8. CONTROL RECOMMENDATIONS
9. RESULTS DOCUMENTATION