Risk analysis: the concepts
Asset, threat, vulnerability, feared event, likelihood and severity, the risk matrix, the four treatments, residual risk and the ISO 27005 cycle: putting the right words on a risk and deciding what to do with it.
- 24 cards
- 5 topics
- Free
The outline, topic by topic
Each topic is weighted the way the exam weighs it.
- Concepts
- Questions
- Sort and link
- Scenarios
- Understand
A few cards from the deck
Threat: what is it?
Show the answer
A potential cause of an incident, human or natural, malicious or accidental, that may harm an asset.
A threat is external to the asset: a competitor, a fire, an administrator's mistake. It only does harm if it finds a vulnerability to exploit.
An online shop runs on a server whose payment library is out of date. A criminal group scans the Internet for this flaw. What is the vulnerability?
- The out-of-date payment library
- The criminal group scanning the Internet
- The customers' payment card data
- The theft of the payment card data, with its consequences
Show the answer
The out-of-date payment library
The server's weakness is the vulnerability. The group is the threat, the data is the asset to protect, and the theft is the feared event whose impact can be measured.
A risk sits where its … and its … cross on the risk matrix.
Show the answer
A risk sits where its likelihood and its severity cross on the risk matrix.
Both axes are graded in a few levels (often four). The higher and further right the point, the higher the priority for treatment.
Vulnerability: what is it?
Show the answer
A weakness in an asset, a process or a safeguard that a threat can exploit.
It can be fixed: unpatched software, a shared password, a backup never tested. Along with impact, it is the element of the risk you act on most directly.
The laptops' disks are now encrypted. Laptop thefts go on at the same rate. In the analysis of the data leak risk, what has dropped, and what should be done with the remaining risk?
- The severity of a leak; the residual risk disappears since the data is encrypted
- The likelihood of the theft; the security officer alone signs off on accepting the rest
- The threat, since there are fewer thieves; the risk is then no longer tracked
- The likelihood of the leak; the residual risk is submitted to management for acceptance
Show the answer
The likelihood of the leak; the residual risk is submitted to management for acceptance
Encryption acts on the vulnerability: theft still happens, but exploiting the data becomes unlikely, so the likelihood of the leak drops; if a leak did happen, it would be just as serious. Read on the 'laptop theft' risk, the same effect is described as a drop in its severity. A residual risk remains (poorly protected key, weak password) that management accepts or treats further, and that keeps being monitored.