Let's take a look at establishing qualitative and quantitative analysis.
When we think of qualitative assessment or analysis,
this typically employs a set of methods,
principles,
or rules for assessing risk based on non‑numeric categories or levels like low,
medium, and high.
Quantitative, on the other hand,
is going to deal in numerical values typically based off of
financial lost and financial impacts.
So qualitative can be described as being subjective,
whereas quantitative heads toward empirical data use so
it's more of an objective exercise.
When we're thinking about qualitative,
the primary word that you should have in mind is this idea of impact.
When you think about quantitative,
the idea should be from the standpoint of impact,
but based off of financial.
So qualitative asked the question,
what would happen to the business function if this was lost?
Whereas, quantitative asked,
what would happen on a financial level if this were lost?
You can normally associate qualitative with categorization and
quantitative with classification of data.
When you imagine a qualitative analysis,
it should be relatively easy,
even though you are dependent on subject matter experts,
and when you think about quantitative,
it is probably going to be quite involved using some
type of mathematical formulas.
Here is an example of a qualitative analysis considering a threat.
If you're familiar with the basic geography of the contiguous
United States and you think about the West Coast and the
likelihood of a category five hurricane,
well at this date at this recording the likelihood is probably low.
But if I said the West Coast of the United States and a 7.0 earthquake,
now we're saying, yep, that could be likely,
and seismologists are predicting that we're overdue for a big one there.
If the likelihood is high, then consider what the impact would be.
So qualitative is a really good thing to start with.
If you end with qualitative,
it may not end up serving your organization very well because
you're only dealing with partial impact information,
operational impact, where now you could move into financial impact information.
It's also helpful because if I try to focus on all threats,
then I'm really focusing on nothing, so likelihood becomes a
cool imperative that we could use for a qualitative to help us
focus resources in an organization.
Quantitative analysis says that I am going to consider the financial loss
that could come from a threat successfully occurring.
Imagine a scenario where you have a data center that is near a body of water
and let's say that the water floods its bounds ever so often.
If we do a quantitative analysis,
what we are going to experience is probably an actuarial formula
that helps us to understand the financial impact.
So we go into that data center and we look at an asset,
let's say that it is a server rack,
and maybe it's the cloud service provider that's doing this and
they know that someone is consuming a private cloud and so that
this is going to be dedicated services.
The first thing that they have to do is obtain the asset value.
So we'll just pick a number,
and we'll say that the value of this asset is $150,000.
Now, how is that determined?
Some people will say is it the cost to replace?
Is it the opportunity loss?
Is it the net present value?
My answer to that is yes.
It depends on how your organization values resources.
What is the way in which they look at cash?
You then would say what is the single loss expectancy of that resource?
How do I get that?
I take the asset value that I determined and I multiply
that by what's called the exposure factor.
How high am I predicting that that flood comes?
Well,
there are actual empirical data that show you how often things
like flooding should occur in a given area.
In the United States, there is something known as farmer's almanac.
When I multiply the asset value by the exposure factor,
then I get my single loss expectancy.
The next thing that I have to do is go to work on the annual rate of occurrence.
How often does this event occur?
I go back to my empirical data and I see that this
event happens once every 5 years, 5 into 1 gives me .2.
Then I'm supposed to take my single loss expectancy results and
multiply that by my annual rate of occurrence.
When I do that,
I then come up with the annual loss expectancy of $3,000 for this 1 situation,
this 1 event with this 1 resource.
Think about that $3,000 and what kind of guide can you imagine
from a business perspective you'd have to follow.
Keep that in mind.
We'll get into it in the next clip as we think about this scenario.
Another type of analysis that an organization could do
would be a privacy impact assessment.
This is an analysis of how a personally identifiable information is collected,
used, shared, and maintained.
So it demonstrates that program managers and system owners have consciously
incorporated privacy protections throughout the development lifecycle of
their system or their program as is related to data.
They also need to make sure that they communicate in a clear fashion
with the public about how they handle information,
including how they would address privacy concerns and safeguard the
information under use by means of the controller.
And finally,
what is the way in which it gets applied when we talk
about a privacy impact assessment?
Well it depends on your industry, it could be an access control system,
it could be a cloud service provider,
it could be a specific agency that's a government agency,
a privately held agency.
Any one of these could actually create a privacy impact assessment.
You should be thinking about this as a controller or as a
processor in your environment as well.
You remember the scenario we use for quantitative analysis?
Keep that in mind.
We're going to revisit that in the next clip when we
talk about risk treatment responses.