Risk Analysis

Front 1

risk is

Back 1

potential harm or loss to a system; the probability that a threat will materialize

Front 2

Identifying risks

Back 2

Actual threat
Possible consequences if threat is realized
Probable frequency of occurrence of threat
Confidence threat will happen

Front 3

Asset

Back 3

A resource, process, product, system, etc. The value is composed of cost of creation,
development, license, support, replacement, public credibility, considered costs, lost intellectual
property if disclosed, and ownership values.

Front 4

Threat

Back 4

Any event that causes an undesirable impact on an organization. Data classification,
information warfare, personnel, criminal, application, operational

Front 5

Vulnerability

Back 5

Absence of a safeguard.

Front 6

RM triple

Back 6

Asset, threat, and vulnerability

Front 7

Exploit

Back 7

A technical means to exploit a vulnerability

Front 8

Exposure Factor (EF)

Back 8

Percentage loss a realized threat would have on an asset. A hardware
failure on a critical system may result in 100% loss.

Front 9

Single Loss Expectancy (SLE)

Back 9

Loss from a single threat. SLE = Asset Value($) x EF.

Front 10

Annualized Rate of Occurrence (ARO)

Back 10

Estimated frequency in which a threat is expected to occur.
The ARO range is from 0 (never) to a large number (e.g., minor threats, such as misspellings

Front 11

Annualized Loss Expectancy (ALE)

Back 11

The total of the SLE multipled by the ARO. ALE = SLE x ARO

Front 12

Safeguard

Back 12

Control or countermeasure to reduce risk associated with a threat.
The absence of a safeguard creates a vulnerability.
Look at the cost/benefit analysis of deploying a safeguard. Include the impact on the
organization of implementing the safeguard.
The safeguard must be auditable. Value to organization of safeguard = ALE (before implementation) – ALE (after implementation)
– annualized safeguard cost.

Front 13

Elements of Risk Analysis

Back 13

Quantitative RA – Assigns objective dollar costs to assets
Qualitative RA – Intangible values of data loss and other issues that are not pure hard costs (i.e.
high, medium and low risk categories)

Front 14

Risk Analysis Steps

Back 14

Identify asset. Estimate potential losses to assets by determining their values.
Identify threats. Analyze potential threats to assets.
Determine risk. Qualitatively and/or quantitatively evaluate the degree of risk.

Front 15

Risk Management Techniques

Back 15

Once you have identified risks, you may choose one or more of the following four risk management techniques
for each identified risk:
Mitigate the risk – Put controls in place that reduce the risk to the organization (e.g., install a
lock on a door to reduce the risk of unauthorized entry).
Avoid the risk – Change the organization's activities to completely avoid the risk (e.g., move
from Florida to Indiana to avoid hurricanes).
Accept the risk – Acknowledge the risk and take no action whatsoever (e.g., realize that there's
a slight chance that a volcano might erupt in southern California but accept that risk without
doing anything about it).
Transfer the risk – Place the burden of the risk on someone else (i.e., buy insurance to protect
against fire).