Title: Risk Assessment
Course: IN 2001 Principle of Information Assurance > Section: Module 4: Chapter Four

Risk Assessment

We can determine the relative risk for each of the vulnerabilities through a process called risk assessment.

Risk assessment assigns a risk rating or score to each information asset, which is useful in gauging the relative risk to each vulnerable information asset and making comparative ratings later in the risk control process.
Introduction to Risk Assessment
Risk is the likelihood of the occurrence of a vulnerability multiplied by the value of the information asset minus the percentage of risk mitigated by current controls plus the uncertainty of current knowledge of the vulnerability.
The goal at this point is to create a method for evaluating the relative risk of each of the listed vulnerabilities.
Likelihood
Likelihood is the probability that a specific vulnerability will be attacked.
- The National Institute of Standards and Technology recommends in Special Publication 800-30 assigning a number between 0.1 for low and 1.0 for high.
- Zero is not used because vulnerabilities with a zero likelihood have been removed from the asset/vulnerability list.

Whatever rating system is utilized for assigning likelihood, use professionalism, experience, and judgment— and use the rating model you select consistently.

Whenever possible, use external references for likelihood values that have been reviewed and adjusted for your specific circumstances.

Risk Determination
For the purpose of relative risk assessment, risk equals likelihood of vulnerability occurrence times value (or impact) minus percentage risk already controlled plus an element of uncertainty.
Identify Possible Controls
1. For each threat and its associated vulnerabilities that have residual risk, create a preliminary list of control ideas.
2. Residual risk is the risk that remains to the information asset even after the existing control has been applied. There are three general categories of controls: policies, programs and technologies.
3. Policies are documents that specify an organization’s approach to security.  There are four types of security policies: general security policy, program security policy, issue-specific policies and systems-specific policies.
4. The general security policy is an executive-level document that outlines the organization’s approach and attitude towards information security and relates the strategic value of information security within the organization.
5. The program security policy is a planning document that outlines the process of implementing security in the organization.  This policy is the blueprint for the analysis, design and implementation of security.
6. Issue-specific policies address the specific implementations or applications of which users should be aware. These policies are typically developed to provide detailed instructions and restrictions associated with security issues.
7. Systems-specific policies address the particular use of certain systems.
8. Programs are activities performed within the organization to improve security.  These include security education, training and awareness programs.
9. Security technologies are the technical implementations of the policies defined by the organization.
10. Access control, a fundamental process of information security, is often considered a simple function of the information system that uses it.

Documenting the Results of Risk Assessment
The goal of this process has been to identify the organization’s information assets that have specific vulnerabilities and list them, ranked according to those that most need protection.

In preparing this list, we have collected and preserved a wealth of factual information about the assets, the threats they face, and the vulnerabilities they expose, as well as some information about the controls that are already in place.

The final summarized document is the ranked vulnerability risk worksheet, which contains the following data:

- Asset: Each vulnerable asset
- Asset Impact: Shows the results for this asset from the weighted factor analysis worksheet
- Vulnerability: Each uncontrolled vulnerability
- Vulnerability Likelihood: The likelihood of the realization of the vulnerability by a threat agent, as noted in the vulnerability analysis step
- Risk-Rating Factor: The figure calculated from the asset impact multiplied by likelihood

The process you develop for risk identification should include defining what function the reports will serve, who is responsible for preparing the reports, and who is responsible for reviewing them.

The ranked vulnerability risk worksheet is the working document for the next step in the risk management process: assessing and controlling risk.