>> Hi everybody. You've identified a risks.
A lot of times this will go in a document called
a risk register which gives you
a way to keep track of your risks,
and once you've identified and documented the risks,
the next step is to figure out a value for the risk.
When we talk about a value,
what we mean is a potential for loss.
Does the risk have a high potential to cost us a lot of
money or could it cause
a lot of damage to data that is compromised?
The next thing we're going to do is figure
out how to prioritize the risks.
We have two types of assessments.
The first is a qualitative assessment. It's easy to do.
It's based on gut instinct and subjective.
It doesn't involve research or gathering data,
but it relies on having
expertise to make this assessment.
It can be an inexpensive and quick way to
begin the prioritization process.
We use terms like high, medium,
or low to describe
the probability and impact of the risk.
Probability is how likely the risk event is to
happen and impact is the severity of the damage or loss.
On the slide, you can see
a probability and impact matrix.
It's like a heatmap showing that the events in green are
low enough probability and
impact that we can live with them.
The yellow ones are ones that we're
concerned about and for the red ones,
we need a very active mitigation strategy
and we should get it implemented very quickly.
Based on this type of qualitative assessment,
you know which types of risks you need to address first.
But if you really want to make
a business decision about how much money to
spend to mitigate a risk you
wouldn't rely on a qualitative assessment.
You'd use that to figure out what to focus on
first but to determine a dollar amount to spend,
reduce quantity of analysis.
In other words, need
a dollar value for the potential for loss.
That being said, you can't always get
a dollar value for a potential for a loss.
Sometimes, potential for
a loss is hard to measure in dollars.
Things like loss of company reputation,
customer confidence,
or employee satisfaction are all hard to quantify.
But for those risk events that you can
quantify you should do so.
It allows you to think about the cost of the loss,
figure out the cost of a countermeasure and make
a good decision based on cost-benefit analysis.
For quantitative analysis, you gain
more expertise and you have to do a little math.
Now on the exam for
anytime that you have to do some math,
you will have a calculator but you need to
remember the formulas and the terms I'm about to go over.
We always start with Asset Value, AV.
What am I protecting and what is it worth?
Then we look at the Exposure Factor, EF.
The exposure factor means the impact of the loss.
As an example, in the event of malware getting on
our server will lose 20 percent of our data.
That 20 percent is the exposure factor.
What we're ultimately looking to come up with is
a Single Loss Expectancy, SLE.
This means how much money do you lose
every time this event materializes.
Then the frequency that the event occurs is
Annual Rate of Occurrence, ARO.
That is tied to probability.
How often per year it is likely to materialize?
When you take the single loss and
multiply it by the frequency per
year you get the Annual Loss Expectancy, ALE.
In other words, how much money you will lose per
year based on how often this event materializes.
Total Cost of Ownership,
TCO is the cost of implementing a safeguard to
include any upfront costs as
well as ongoing maintenance costs.
Then we have the Return On Investment,
ROI which is the amount of money you save by implementing
the control and is also referred to
as the value of the safeguard or control.
Now, it's important to note that the benefit of
a safeguard may not always be measured in dollars.
Sometimes we implement a control
in order to be in compliance with
regulation and we won't have a dollar amount for
that but the benefit is that we are in compliance.
These are the formulas.
Single Loss Expectancy equals
Asset Value times Exposure Factor.
As an example, let's say I have a $300,000 warehouse,
it catches fire and 70 percent is lost.
A $300,000 asset multiplied by 0.70 and
Exposure Factor equals
a Single Loss Expectancy of $210,000.
How often does that happen per year?
Let's see what happens once every 20 years.
That's 0.05 for the Annual Rate of Occurrence.
As the next formula is Annual Loss of Expectancy equals
Single Loss Expectancy multiplied
by the Annual Rate of Occurrence.
That means $210,000 multiplied by
0.05 which equals $10,500.
The Annual Loss Expectancy is
$10,500 before you've implemented any controls.
Now, we're going to want to compare that to the cost of
the control and figure out
a positive return on investment.
We have to figure out what the cost of
the control is which is going to
be an initial fee plus any yearly fees.
Make the example easy and say that the control is
a fire suppression system and
the cost of the control is $5,000 per year.
If that control were
100 percent successful and I went from
losing $10,500 a year to losing zero per year,
then a 5,000 per year expense seems a good investment.
But usually, our controls are not 100 percent effective.
We have to determine how much we're losing
before we've implemented the control and
how much we lose after we implement the control plus
the annual cost of the control to
determine the Return On Investment.
Let's say that in our example,
the control reduces the Exposure Factor
to 30 percent instead of 70 percent.
That means the new SLE after control is
$300,000 multiplied by 0.30 which equals $90,000.
How much do I lose per year after I mitigate the control?
Well, $90,000 multiplied by 0.5 equals $4,500.
The new ALE after control is $4,500.
Instead of losing $10,500 per year,
I'm losing $4,500 per year and I'm paying
$5,000 per year for
the control for a total of 9,500 a year.
That means my ROI is $1,000.
The key takeaways for
risk assessments are that it's all about determining
a value for risk or your potential for
loss and we can do that with qualitative analysis.
We're looking at probability and impact and using
those subjective ideas like low, medium, and high.
Or we can determine a dollar value for
that loss through quantitative analysis.
But remember, not all assets
and not all risks can be quantified.