- In lesson 24.2, we're gonna be talking about
Risk Assessment and Risk Analysis.
Now risk assessment is a structured method
to understand risk.
And there are four distinct processes
within a risk assessment, risk identification
risk analysis, risk evaluation and risk response.
So let's go through what each of those actually mean.
Identification, analysis, evaluation and response.
Risk identification is the process of determining
and documenting risk scenarios
that the organization faces.
What do we take into consideration?
Well, exposures, threats, vulnerabilities,
controls and consequences, right?
So dangers, weaknesses, controls and consequences.
Analysis is the process by which the likelihood
and the impact, and the level of risk are determined.
So when we do a risk analysis,
we're saying how likely is it this event would occur?
What would be the impact if it does?
And from that, we can determine our level of risk.
Evaluation is the process of comparing
the results of the risk analysis
and the organization's risk appetite statement
and risk tolerance.
And lastly, response is a process of determining
a recommended course of action,
and that's also referred to as risk treatment.
And how often should we do a risk assessment?
Well, different organizations do this differently.
Some are ad hoc, some are recurring, some do one time,
some do continuous, and many do a combination of these.
An ad hoc risk assessment is a spontaneous
sort of unplanned evaluation of risk,
and it's typically undertaken in response
to a particular event, a specific event or issue.
Recurring risk assessments is gonna be
a periodic review of risks that takes place
on a regular basis.
It could be weekly, it could be monthly,
it could be quarterly, it could be annually,
it could be more.
It could be every two years, every three years,
but it's scheduled out.
One time risk assessment
is a single evaluation of risk undertaken
at a specific point in time,
and that's typically in response
to a new project or venture.
So we might say for every new project
there will be a risk assessment.
We won't do a new project risk assessment
on that ever again
but we'll probably do follow up risk assessments.
But just maybe once it's a full application
or a full system.
And then continuous risk assessment
is the dynamic and iterative approach
that involves constant monitoring of risks
and changes in the risk environment.
Again, most organizations have a hybrid approach.
Risk analysis is a process by determining
the likelihood, the impact
and what level of risk we actually have.
Now, the outcome is inherent
and residual risk ratings.
Inherent risk is the level of risk
before controls or safeguards have been implemented.
Residual risk is the level of risk
after controls or safeguards have been implemented.
So we figure out the inherent risk,
then we'll look at our controls,
then we'll figure out our residual risk.
Then there are two primary risk analysis approaches
qualitative and quantitative.
A qualitative risk analysis uses narrative
to describe likelihood and impact,
and the outcome is a descriptor,
like high risk, medium risk or low risk.
Now, I don't wanna give you the impression
that just because we're using these descriptors
or they're narrative that these are subjective, they're not.
They're generally very, very well defined.
A quantitative risk analysis assigns numeric
and monetary values to likelihood and impact.
So the outcome is always gonna be monetary or financial.
So qualitative risk assessment uses these
well-defined descriptive terminology
to indicate likelihood impact and level of risk.
The qualitative risk analysis approach
is appropriate in situations
where there's non-tangible elements of risk.
So for example, reputation that need to be considered
and/or when there's a lack of meaningful numeric data.
Now, results are generally presented
in what's known as a risk range map.
There's an example of a risk range map,
where we have different levels based on
again the descriptors that we're using.
And we ultimately determine whether it's
low risk, an acceptable range or in an unacceptable range.
A quantitative risk analysis assigns numeric values
to all elements of the analysis.
So let's go through those elements.
And this comes up a lot as a test question.
We have an asset value.
Now this is gonna be whatever the target is
of the risk assessment.
That asset has to be assigned a value
and that's the monetary value of that resource
or of that asset to the organization.
Then we have exposure factor
and you'll see that abbreviated as EF,
and that's the percent of the asset value
that would be impacted if this event occurred.
And it can be from 0% to 100%.
So exposure factor is really another way to say impact.
Then we have what's known as an SLE.
A single loss expectancy and that's the financial impact
of a single event or occurrence.
And there's a formula that you need to know
which is single loss expectancy
is the asset value times the exposure factor.
And we'll work through an example in just a moment.
Then we have the annualized rate of occurrence
which is how many times in the course of a single year,
in 12 months is the event expected to occur?
And that's just gonna be a straight up number.
If it's one, it would be one.
If it's five, it would be five.
What if we thought it would happen every other year?
Well, 0.5 every three years, 0.33, right?
Every 10 years 0.10.
And then lastly, we have our annualized loss expectancy.
And that's the financial impact on an annualized basis.
Why do we need to annualize?
Because we annualize our financial statements,
we annualize our budgets.
We make all of our decisions on an annual basis.
We have annual reporting, annual taxes.
So we need to annualize the loss.
So our annualized loss expectancy formula
is ALE, annualized loss expectancy equals SLE,
single loss expectancy times ARO,
annualized rate of occurrence.
So let's illustrate that.
So first, let's do a single loss expectancy.
Remember, single loss expectancy
is asset value times exposure factor.
Let's say the target of our analysis
is an e-commerce server.
And the way we decided to value the asset
was just revenue from one hour of e-commerce.
It could have been revenue from a day, a week,
a month, a year, but we're just doing revenue
from an hour for simplicity's sake.
And we're saying revenue
from one hour of e-commerce is $20,000.
And then the particular threat
we're looking at here is a DDoS attack.
And we're wondering what would be the impact
of a DDoS attack.
And we consult with our consultants
and they say, well, you know if you had a DDoS attack
on your e-commerce server probably 85%
of your online activity would be impacted.
So there's my exposure factor, 85%.
So 20,000, which was my asset value times 0.85,
'cause of my 85% says my single loss expectancy
is going to be $17,000.
So if I have one hour of DDoS disruption
on my e-commerce platform
my revenue hit is gonna be $17,000.
Okay, so how do we annualize this?
Well, remember, ALE is SLE times ARO.
So that's the annualized loss expectancy
is a single loss expectancy times
the annualized rate of occurrence.
So my single loss expectancy
for an hour of DDoS disruption, remember was $17,000.
Again, we're talking to our consultants
and we say based on the current threat
and controls environment
they say, well, you know, we expect there'll be
five hours of DDoS disruption in a year.
That means we're gonna take our 17,000,
that was for the one hour
times five and we're gonna get $85,000,
and that's gonna be our loss on an annualized basis.
At which point we're gonna have to be making
a bunch of decisions.
Is that acceptable?
And if it's not, what other controls can we put in place
to bring that number down?
But we'll also have to consider the cost of those controls
and we know that those controls
aren't gonna be 100% effective.
So what still might be our loss
we'll do that in a cost benefit analysis
and we'll look at that in just a moment.
But here's an alternate scenario.
What if they said,
well no, we only think that there'll be about
maybe 30 minutes of DDoS disruption per year.
That's really what we think it'll be, right?
30 minutes a year.
Well, at that point would be 17,000,
which was our one hour single loss expectancy,
times 0.5 and instead of 85,000,
now we get 8,500, and 8,500 is a really different number.
And we might say, oh, well for 8,500
we're just gonna accept that we'll take our chances.
So knowing really what the number actually is
is very important and informs lots of different decisions.
But let's say it was 85,000,
and now we're saying,
okay we're gonna put some additional controls in place.
So let's walk through
how we would do a cost benefit analysis.
Well, we just did step one already.
We calculated the annualized loss expectancy
and we'll refer to that as ALE-1.
Then we'll identify mitigating controls.
Then we're gonna recalculate the ALE
with the mitigating controls.
We'll do the same process again
but knowing what our controls are
and see how that changes,
and that will be called ALE-2.
Then ultimately what we're gonna do
is we're gonna compare ALE-1
like the 85,000 that we had in our example
with ALE-2 because we've hopefully brought that number down
plus the cost of new controls.
So maybe we've brought it down to 30,000,
and our controls are gonna cost us five.
So now it's 35,000 versus 85.
Maybe brought it to 30,000,
but our controls are gonna cost us a 100.
Well, we would've lost 85,000
and now with the new controls it would be 130,000.
Well, we're not gonna do that.
So we're going to do the ALE-1,
identify the mitigating controls,
do ALE-2 and then compare ALE-1 to ALE-2
plus the cost of the new control.
And that cost of the new control
isn't just the cost of buying it, right?
It's also the cost of implementation,
management and monitoring.
And that, my friends, brings us to a three second challenge.
Five challenge questions, three seconds each.
You know how to do it.
The level of risk before controls
or safeguards have been implemented.
One, two, three.
It's gonna be inherent
or the level of risk after is residual.
The risk analysis approach that's appropriate
when there's a lack of meaningful numeric data.
One, two, three.
That's gonna be a qualitative.
Number three, AV times EF equals what?
One, two, three.
It's gonna be SLE, single loss expectancy.
Number four SLE times ARO equals what?
This is easy 'cause you've already done the other one.
One, two, three.
It's gonna be annualized loss expectancy or ALE.
Lastly, number five.
Dynamic and iterative risk assessment approach
that involves constant monitoring.
What's that called?
It was way at the beginning of the lesson.
One, two, three.
And that is continuous.
And that brings us to a security in action.
And we're gonna do a quantitative risk analysis.
So your company hosts websites.
You have 300 web servers that are geographically segmented.
Each server hosts an average of 100 websites.
Businesses pay a monthly fee of $75
for money back guaranteed service.
Your organization is concerned about a ransomware attack.
Now, your IT team estimates
that a ransomware attack could encrypt 60% of the servers
before they could mitigate the attack.
And they suggest that a ransom attack
could occur every two years,
and that it would take three days to recover.
So what's our SLE and our ALE?
Okay, so let's go through some numbers together.
We've got 300 web servers.
They're geographically segmented.
Each one has 100 websites.
Our businesses pay $75 for money back guaranteed of service.
So if they don't have service,
I assume for any part of that month,
they get their money back.
You're concerned about ransomware.
We said that if we had a ransomware attack
probably get to about 60% encryption rate
before we could mitigate the attack.
We might be subject to one every two years
and it would take us three days to recover.
So we wanna do some SLE and ALE calculations.
Go ahead and put me on pause and see how you do,
and come on back and we'll do 'em together.
Well, our asset value is going to be 300.
That's our 300 web servers times 100 times $75.
So we'll do that 100 times 75,
because we said each one hosts a average
of 100 websites at $75 per website.
So 100 times 75 would be per server.
And we said we have 300 web servers.
So it looks like we have 2,250,000 is our asset value.
Our exposure factor we said was 60%.
So our single loss expectancy
is going to be 2,250,000 times 0.6.
Why? Because they have that money back guarantee.
So we're assuming if they have the three days of outage
well, we're gonna have to refund them that full $75,
'cause we said they had a money back guarantee.
That's why we're doing it by the monthly.
So the single loss expectancy
$2,250,000 times 0.6 is $1,350,000, right?
'Cause SLE is the AV times EF.
Our annualized rate occurrence,
so it could happen once every two years.
That would make our ARO 0.5.
So our annualized loss expectancy
would be $1,000,350 times 0.5 or $675,000.
And from that number, we would decide, is it okay?
Probably not.
So what else are we gonna invest in
to bring that number down to a much more reasonable place?
But you really need to be able to go through these.
Know definitely, definitely know your formulas
but be able to identify the AV, the asset value,
the EF, the exposure factor.
Know the SLE formula, which is AV times EF.
Understand what an annualized rate of occurrence is
and know the ALE formula, which is SLE times ARO.
You can do that.
Well, then you're doing security in action.
There's your word cloud.
I know you know what to do
but these are all really important concepts
and always come up on the exam.
So really make sure you understand these before moving on.
If not, go back through the lesson
and when you're ready
I'll be waiting for you at the next lesson.