Topics in this domain
- IT Risk Events, Loss Types and Business Outcomes
- Threat Sources, Actors and Motivations
- The Changing Threat Landscape and Threat Modelling
- Vulnerabilities, Control Deficiencies and Risk Conditions
- Identifying Internal and External Risk Factors
- Building IT Risk Scenarios
- Evaluating Scenarios for Completeness and Relevance
- Common Risk Scenario Errors
- Risk Assessment Concepts and Standards
- Qualitative, Semi-Quantitative and Quantitative Analysis
- Quantitative Methods: ALE, FAIR and Monte Carlo
- Risk Analysis Techniques: Bow-Tie, Fault Tree, Event Tree and Delphi
- Choosing a Consistent Assessment Methodology
- Translating Technical Events into Business Impact
- Business Impact Analysis for Risk Prioritisation
- Inherent and Residual Risk
- Evaluating Risk Against Business Objectives and Appetite
- Creating and Maintaining the IT Risk Register
- Using the Risk Register to Support Decisions
Risk Assessment Concepts and Standards
The ingredients of risk
Risk combines the likelihood of a threat exploiting a vulnerability and the impact on an asset.
The standard steps
Existing controls must be considered, and tested where possible, before residual risk is estimated.
Standards that describe it
| Standard | What it offers |
|---|---|
| NIST SP 800-30 | How to prepare, conduct and maintain IT risk assessments |
| ISO/IEC 27005 | Information security risk management for ISO 27001 |
| ISO 31000 / IEC 31010 | Generic risk process and assessment techniques |
Assessment is not a scan
A vulnerability scan lists technical weaknesses. A risk assessment asks which threats could use them, against which assets, how likely that is and what it would cost the business. Scans are one input, not the assessment.
Example. A scan found 2,000 vulnerabilities. The risk assessment showed that 40 of them, on three internet-facing systems holding customer data, made up most of the business risk.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| FIRST step after setting scope | Identify and value assets |
| Before estimating residual risk | Evaluate existing controls |
| Difference between a scan and an assessment | An assessment considers threats, likelihood and business impact |
| Standard for IT risk assessment | NIST SP 800-30 |
In short
- Risk combines the likelihood of a threat exploiting a vulnerability and the impact on an asset.
- The standard steps are scope and criteria, assets, threats and vulnerabilities, existing controls, likelihood and impact, then evaluate and record.
- Existing controls must be considered, and tested where possible, before estimating residual risk.
- NIST SP 800-30 and ISO/IEC 27005 describe IT and information security risk assessment.
- Risk assessment is repeated periodically and when significant change occurs.
Exam traps
- Starting with threats before identifying the assets at risk.
- Assuming existing controls work without checking.
- Treating a vulnerability scan as a risk assessment.
- Running a one-off assessment and never updating it.
Slides
Click the slide and use the arrow keys. F toggles full screen.
The ingredients of risk
The standard steps
1 / 8