There are assets, threats, and vulnerabilities,
but a risk assessment is not complete until I've looked at these two
very difficult areas of risk likelihood and impact.
If we went back to the diagram we had before of a threat source using a threat
event to exploit a vulnerability and thereby impact an asset,
we see that likelihood is used in order to try to determine how
likely is it that there will be an attack.
An impact is used to determine what would be the impact if there was an attack.
Let's take the example of a car accident.
The car accident is very much a combination of both likelihood and impact.
Those can be a number of different risk factors and predisposing conditions.
For example, does the car have good tires?
Bad tires means that we have a predisposing condition which is
going to be a higher likelihood of an accident.
Are the roads icy?
Yeah.
Or is the driver just a brand‑new driver or are they distracted or tired?
All of these can affect the likelihood of there being an accident,
but of course, we also have to consider are there other vehicles on the road?
A person can have a risk in an accident that was by no means their fault,
somebody else came into their lane.
And so these are things that are, as we know,
very often beyond our control as well.
When we look at the car accident, we see there is a wide variety of impact.
There can be an impact if a car goes into the ditch,
but it's probably far more serious if the car hits a tree,
and even more serious again if the car hits another vehicle.
Going into the ditch,
yeah maybe it's just a bit of mud and then needs to be pulled out,
going into a tree, we've got damage, and so on,
but when he hit another vehicle, it could be a catastrophic event.
So the same event, an accident,
could have a wide variety of different consequence or
impact depending on the situation.
So with all of this, hopefully now we can identify what the risks are.
We come up with a list of incident scenarios, we look at the
consequence if those were to happen and how that would impact the
assets and business processes of the organization.
So the key points review.
Risk assessment is essential because it's the foundation of the
decisions we make for a good IT security program.
As we'll look at, it helps us justify the controls we use,
it informs management about our level of risk,
and it demonstrates and gives us a way to measure whether or
not we are compliant with good practices,
laws, or standards.
The results of the risk assessment are the foundation
of risk treatment or risk response.