Risk Management

Risk identification, assessment, treatment strategies, BIA, and quantitative vs. qualitative analysis.

Risk Terminology

Term	Definition	Example
Threat	Any circumstance or event that could harm an asset	Ransomware attack, hurricane, disgruntled employee
Vulnerability	A weakness that can be exploited by a threat	Unpatched OS, weak password policy, unlocked server room
Risk	The likelihood × impact of a threat exploiting a vulnerability	Risk of ransomware = high likelihood × high impact = Critical
Asset	What you're trying to protect (hardware, data, people, reputation)	Customer database, production servers, intellectual property
Residual Risk	Risk remaining after controls are applied	After MFA + patching, remaining ransomware risk is Low
Inherent Risk	Risk before any controls are applied	Raw risk of a new web application before security review
Risk Appetite	Amount of risk an organization is willing to accept	A bank has very low risk appetite; a startup may accept more
Risk Tolerance	Acceptable deviation from risk appetite for specific scenarios	Accept slightly higher risk for a short-term project

Risk Calculation

Risk = Likelihood (Probability) × Impact

Quantitative formulas:

SLE (Single Loss Expectancy) = Asset Value × Exposure Factor (EF)
ARO (Annual Rate of Occurrence) = expected frequency per year
ALE (Annual Loss Expectancy) = SLE × ARO

Example:
Asset value = $100,000 (server)
Exposure factor = 0.3 (30% of server lost in a fire)
SLE = $100,000 × 0.3 = $30,000
ARO = 0.1 (fire once every 10 years)
ALE = $30,000 × 0.1 = $3,000/year
→ Installing a sprinkler system costs $500/year → worthwhile!

Qualitative vs. Quantitative Risk Analysis

	Qualitative	Quantitative
Method	Subjective ratings (High/Medium/Low)	Numerical values (ALE, SLE, ARO)
Pros	Fast; no hard data needed; good for initial triage	Objective; enables cost-benefit analysis; defensible to management
Cons	Subjective; hard to compare or prioritize	Time-consuming; requires accurate asset valuation and probability data
Tools	Risk matrix (heat map)	ALE calculations, Monte Carlo simulation

Risk Treatment Strategies

Strategy	Description	Example
Accept	Acknowledge the risk and consciously choose not to act. Used when cost of control > cost of risk.	Accept the risk of a very rare, low-impact event (within risk appetite)
Transfer	Shift financial impact to a third party.	Cyber insurance; outsourcing to a managed security provider
Avoid	Eliminate the activity or asset that creates the risk.	Not launching a risky product feature; discontinuing a vulnerable service
Mitigate / Reduce	Implement controls to reduce likelihood or impact.	Patching, MFA, encryption, network segmentation

Note: "Ignore" is never an acceptable risk treatment option on the exam!

Business Impact Analysis (BIA)

BIA identifies the organization's critical business functions and quantifies the impact of their disruption.

Identifies critical assets and their dependencies
Determines RTO/RPO for each critical system
Assesses financial, operational, regulatory, and reputational impact of downtime
Outputs prioritized recovery order for DR/BCP planning
MTD (Maximum Tolerable Downtime): The longest a function can be unavailable before causing permanent harm

Supply Chain Risk

Third-party software/hardware components introduce inherited risk
SBOM (Software Bill of Materials): Inventory of all software components and dependencies — enables rapid response when a component CVE is disclosed
Hardware supply chain: tampered chips, counterfeit components
Due diligence: vendor security assessments before procurement

Exam Tip: Risk treatment memory aid: TAMA — Transfer, Accept, Mitigate, Avoid. Remember: residual risk always remains after any control. Risk transference (insurance) doesn't eliminate the risk — only its financial impact. BIA outputs inform RTO/RPO which drive DR site decisions.