CYS403 · Chapter 5 · Annotated SlidesRisk Assessment Approaches
Original
Overview

Risk Assessment Approaches

Why risk assessments matter, their critical components, quantitative assessment with SLE, ARO, ALE and cost–benefit analysis, qualitative assessment with likelihood/impact matrices, and the risk assessment report.

How to read this page

Every original slide is shown unchanged. Yellow marks on a slide point to a numbered note: hover or tap a mark to jump to its note, and hover a note to see its marks. Questions tagged Past exam appeared on a real paper; Prediction questions are likely angles, not confirmed. Pick an answer to each question: a wrong pick tells you why it is wrong, so you can try again.

All 39 slides
  1. 1 Slide 1
  2. 2 ▪ CLO 2: Synthesize the principles of cyber security risk management
  3. 3 T VA worksheet
  4. 4 Class Activity
  5. 5 Quiz will be next Sunday 13/09/2026
  6. 6 What is next?
  7. 7 Risk assessment
  8. 8 Importance of Risk assessment
  9. 9 Risk assessment
  10. 10 Risk assessment
  11. 11 Critical Components of a Risk Assessment
  12. 12 Critical Components of a Risk Assessment
  13. 13 Critical Components of a Risk Assessment
  14. 14 Critical Components of a Risk Assessment
  15. 15 Types of Risk assessment
  16. 16 Types of Risk assessment
  17. 17 Quantitative Risk Assessments
  18. 18 Quantitative Risk Assessments
  19. 19 Class activity
  20. 20 Class activity
  21. 21 Class activity
  22. 22 Class activity
  23. 23 Quantitative Risk assessment
  24. 24 Qualitative Risk Assessments
  25. 25 Qualitative Risk Assessments
  26. 26 Qualitative Risk Assessments
  27. 27 Qualitative Risk Assessments
  28. 28 Risk Assessments Report
  29. 29 Risk Determination
  30. 30 Likelihood
  31. 31 ▪ Information Asset A
  32. 32 Example (1)
  33. 33 Example (1 continued)
  34. 34 Example (1 continued)
  35. 35 Assessment
  36. 36 Ranked Risk Worksheet
  37. 37 Deliverable Purpose
  38. 38 Slide 38
  39. 39 Slide 39
Slide 1 / 39

Slide 1

Slide 1: Slide 1
Slide 2 / 39

▪ CLO 2: Synthesize the principles of cyber security risk management

Slide 2: ▪ CLO 2: Synthesize the principles of cyber security risk management
Slide 3 / 39

T VA worksheet

Slide 3: T VA worksheet
Slide 4 / 39

Class Activity

Slide 4: Class Activity
Slide 5 / 39

Quiz will be next Sunday 13/09/2026

Slide 5: Quiz will be next Sunday 13/09/2026
Slide 6 / 39

What is next?

Slide 6: What is next?
Slide 7 / 39

Risk assessment

Slide 7: Risk assessment
Slide 8 / 39

Importance of Risk assessment

Slide 8: Importance of Risk assessment

Notes

  1. A risk assessment tells management which risks matter most and where to spend money.

Slide 9 / 39

Risk assessment

Slide 9: Risk assessment
Slide 10 / 39

Risk assessment

Slide 10: Risk assessment
Slide 11 / 39

Critical Components of a Risk Assessment

Slide 11: Critical Components of a Risk Assessment

Notes

  1. Critical components: scope, data collection, threats and vulnerabilities, likelihood, impact, risk determination, recommendations, documentation.

Slide 12 / 39

Critical Components of a Risk Assessment

Slide 12: Critical Components of a Risk Assessment
Slide 13 / 39

Critical Components of a Risk Assessment

Slide 13: Critical Components of a Risk Assessment
Slide 14 / 39

Critical Components of a Risk Assessment

Slide 14: Critical Components of a Risk Assessment
Slide 15 / 39

Types of Risk assessment

Slide 15: Types of Risk assessment

Notes

  1. Types: quantitative, qualitative, and hybrid (semi-quantitative).

Slide 16 / 39

Types of Risk assessment

Slide 16: Types of Risk assessment
Slide 17 / 39

Quantitative Risk Assessments

Slide 17: Quantitative Risk Assessments

Notes

  1. SLE = AV × EF · ARO = how many times a year · ALE = SLE × ARO · Value of a control = ALE(before) − ALE(after) − annual cost of the control.

  2. Tip SLE = AV × EF · ARO = how many times a year · ALE = SLE × ARO · Value of a control = ALE(before) − ALE(after) − annual cost of the control.

  3. Seen again Chapter 2: Risk Management Fundamentals, slide 30: the same formulas

Exam angle

PredictionQ1

ALE is $64,000 a year. A mitigation service cuts attacks to 80% of the original number and costs $1,000/month + $1,500 installation. What is the control’s value in year one?

Compare with the model answer

ALE after = 64,000 × 0.8 = $51,200. Annual cost = 12 × 1,000 + 1,500 = $13,500. Value = 64,000 − 51,200 − 13,500 = −$700, so in the first year the control costs more than it saves.

Slide 18 / 39

Quantitative Risk Assessments

Slide 18: Quantitative Risk Assessments
Slide 19 / 39

Class activity

Slide 19: Class activity
Slide 20 / 39

Class activity

Slide 20: Class activity
Slide 21 / 39

Class activity

Slide 21: Class activity
Slide 22 / 39

Class activity

Slide 22: Class activity
Slide 23 / 39

Quantitative Risk assessment

Slide 23: Quantitative Risk assessment

Notes

  1. Cost–benefit analysis (CBA) is the BEST technique to decide whether a control is cost-effective.

Exam angle

Past exam · Major exam

the technique for deciding if a control is cost-effective

PredictionQ1

The best technique to decide whether a control is cost-effective is:

Slide 24 / 39

Qualitative Risk Assessments

Slide 24: Qualitative Risk Assessments

Notes

  1. Qualitative: rate likelihood and impact (e.g. low/medium/high) and read the risk level from a matrix.

Exam angle

Slide 25 / 39

Qualitative Risk Assessments

Slide 25: Qualitative Risk Assessments
Slide 26 / 39

Qualitative Risk Assessments

Slide 26: Qualitative Risk Assessments
Slide 27 / 39

Qualitative Risk Assessments

Slide 27: Qualitative Risk Assessments
Slide 28 / 39

Risk Assessments Report

Slide 28: Risk Assessments Report

Notes

  1. The report: findings, risk ratings, recommended controls, residual risk; presented to management for decisions.

Slide 29 / 39

Risk Determination

Slide 29: Risk Determination
Slide 30 / 39

Likelihood

Slide 30: Likelihood
Slide 31 / 39

▪ Information Asset A

Slide 31: ▪ Information Asset A
Slide 32 / 39

Example (1)

Slide 32: Example (1)
Slide 33 / 39

Example (1 continued)

Slide 33: Example (1 continued)
Slide 34 / 39

Example (1 continued)

Slide 34: Example (1 continued)
Slide 35 / 39

Assessment

Slide 35: Assessment
Slide 36 / 39

Ranked Risk Worksheet

Slide 36: Ranked Risk Worksheet
Slide 37 / 39

Deliverable Purpose

Slide 37: Deliverable Purpose
Slide 38 / 39

Slide 38

Slide 38: Slide 38
Slide 39 / 39

Slide 39

Slide 39: Slide 39