A weakness that a threat can exploit is a:
Risk Management Fundamentals
Definitions of risk, threat, vulnerability, asset, exposure and safeguard, risk factors, the risk equation, risk-management steps and the risk register, quantitative (SLE, ARO, ALE) vs. qualitative analysis, mitigation options, countermeasure selection and types of security controls.
How to read this page
Every original slide is shown unchanged. Yellow marks on a slide point to a numbered note: hover or tap a mark to jump to its note, and hover a note to see its marks. Questions tagged Past exam appeared on a real paper; Prediction questions are likely angles, not confirmed. Pick an answer to each question: a wrong pick tells you why it is wrong, so you can try again.
All 47 slides
- 1 Slide 1
- 2 Intended Learning Outcomes
- 3 Agenda
- 4 Risk?
- 5 Definition of risk
- 6 Definition of Risk
- 7 Risk is
- 8 Some terms and concepts
- 9 Some terms and concepts
- 10 Some terms and concepts
- 11 Some terms and concepts
- 12 Risk Factors
- 13 Risk Factors
- 14 Understanding Risk
- 15 Risk Management Concept Flow
- 16 An Overview on Risk Management
- 17 An Overview on Risk Management
- 18 Risk Management
- 19 Risk Management
- 20 Slide 20
- 21 The Risk Equation
- 22 Risk Management Steps
- 23 Risk Management Steps
- 24 Risk Management Steps
- 25 Risk Management Steps
- 26 Risk Management Steps
- 27 Risk Register Sample
- 28 Automated Tools for Risk Management
- 29 Qualitative versus Quantitative
- 30 Quantitative Risk Analysis
- 31 Quantitative Analysis Steps
- 32 Real example
- 33 Ranked Risk Worksheet
- 34 Qualitative Risk Analysis
- 35 Qualitative Risk Analysis Critical Factors
- 36 Risk Levels (AS/NZ 4360 Standard)
- 37 5 top Qualitative RA Techniques
- 38 Slide 38
- 39 Quantitative vs. Qualitative
- 40 Risk Mitigation Options
- 41 The Right Amount of Security
- 42 Countermeasure Selection
- 43 Countermeasure Selection Principles
- 44 Countermeasure Selection Principles
- 45 Types of Security Controls
- 46 Slide 46
- 47 Slide 47
Slide 1
Intended Learning Outcomes
Agenda
Risk?
Definition of risk
Notes
Risk = the likelihood that a threat exploits a vulnerability, and the impact if it does.
Definition of Risk
Risk is
Some terms and concepts
Notes
Asset: anything of value. Threat: potential cause of harm. Vulnerability: a weakness. Exposure: being open to loss. Safeguard/countermeasure: reduces risk.
Exam angle
Some terms and concepts
Some terms and concepts
Some terms and concepts
Risk Factors
Notes
Threat amplifiers raise the chance of an attack (publicity, a known weakness); threat inhibitors lower it (fear of capture, strong controls).
Exam angle
threat amplifiers and inhibitors
Risk Factors
Understanding Risk
Risk Management Concept Flow
An Overview on Risk Management
Notes
Risk management = identify, assess, and reduce risk to an acceptable level. It never removes ALL risk.
Exam angle
the best definition of risk management
the prime directive of risk management
The goal of risk management is to:
An Overview on Risk Management
Risk Management
Risk Management
Slide 20
The Risk Equation
Notes
Total risk = threats × vulnerabilities × asset value. Residual risk = total risk − controls gap (what is left after controls).
Exam angle
the formula for total risk
Total risk is represented by:
Risk Management Steps
Notes
Steps: identify assets → identify threats and vulnerabilities → assess (likelihood, impact) → choose responses → monitor.
Exam angle
when risk identification happens
Risk Management Steps
Risk Management Steps
Risk Management Steps
Risk Management Steps
Risk Register Sample
Notes
Risk register: one row per risk with owner, likelihood, impact, rating, response and status.
Automated Tools for Risk Management
Qualitative versus Quantitative
Notes
Quantitative: numbers and money (objective, costly). Qualitative: ratings like high/medium/low (fast, subjective).
Exam angle
what a quantitative analysis is
Quantitative Risk Analysis
Notes
SLE = AV × EF · ARO = how many times a year · ALE = SLE × ARO · Value of a control = ALE(before) − ALE(after) − annual cost of the control.
Tip SLE = AV × EF · ARO = how many times a year · ALE = SLE × ARO · Value of a control = ALE(before) − ALE(after) − annual cost of the control.
Exam angle
the DoS SLE / ARO / ALE / cost–benefit calculation
Asset value $100,000, exposure factor 25%, ARO 0.5. ALE =
- SLE = 25,000; ALE = 25,000 × 0.5.
Profit is $20,000 a week and a DoS attack lowers sales by 40%. Four attacks happen every 6 months. Find SLE, ARO and ALE.
Compare with the model answer
SLE = 20,000 × 0.40 = $8,000. ARO = 4 per 6 months = 8 per year. ALE = 8,000 × 8 = $64,000.
Quantitative Analysis Steps
Real example
Ranked Risk Worksheet
Qualitative Risk Analysis
Notes
Qualitative analysis uses scenarios, ratings and expert judgement (Delphi, brainstorming, checklists).
Qualitative Risk Analysis Critical Factors
Risk Levels (AS/NZ 4360 Standard)
5 top Qualitative RA Techniques
Slide 38
Quantitative vs. Qualitative
Risk Mitigation Options
Notes
Four responses: mitigate (reduce), transfer (insurance, outsourcing), avoid (stop the activity), accept (document and live with it).
Trap Accepting a risk is a valid, documented decision when the cost of a control exceeds the expected loss.
Exam angle
an example of mitigation
when not acting is acceptable; when to avoid
Buying cyber insurance is risk:
It is acceptable not to act on an identified risk when:
The Right Amount of Security
Countermeasure Selection
Notes
Choose a countermeasure when its value is positive: ALE before − ALE after − annual cost > 0 (cost–benefit analysis).
Countermeasure Selection Principles
Countermeasure Selection Principles
Types of Security Controls
Notes
Control types by nature: administrative, technical (logical), physical. By function: preventive, detective, corrective, deterrent, recovery, compensating.
Exam angle
logical access control category; encrypting payment files
Logical mechanisms that control access and authenticate users are:
Encrypting payment files to stop tampering is a:
Slide 46
Slide 47
