Generic risks
The six families of risk for a system in operation, probability, severity and the criticality matrix, the four ways to treat a risk, the single point of failure, MTBF and MTTR.
- 27 cards
- 6 topics
- Free
The outline, topic by topic
Each topic is weighted the way the exam weighs it.
- Concepts
- Questions
- Sort and link
- The numbers
- Scenarios
- Understand
A few cards from the deck
Operational risk: what is it?
Show the answer
A possible event that, if it happens, degrades or interrupts a service; it is described by its probability and its severity.
Six families cover most cases: hardware, software, human, network and supplier, disaster, malicious action. Naming them stops you forgetting one when you prepare a plan.
A server has an MTBF of 1,000 hours and an MTTR of 10 hours. What is its availability, rounded?
99.0%99.9%90.9%99.99%
Show the answer
99.0%1,000 / (1,000 + 10) = 0.990: the server is down about 1% of the time. Writing 99.9% amounts to dividing the MTTR by 10 for no reason.
Dropping the activity that creates a risk is … it; lowering its probability or severity is … it.
Show the answer
Dropping the activity that creates a risk is avoiding it; lowering its probability or severity is reducing it.
A second disk in a mirror reduces the risk of failure; no longer storing the data on site avoids it. Accepting means deciding, knowingly, to do nothing.
Risk matrix: what is it?
Show the answer
A grid that crosses a risk's probability with its severity to rank it and decide which ones to treat first.
A frequent but harmless risk and a rare but devastating one do not read the same: criticality takes both into account, never just one axis.