CompTIA Security+ (SY0-801)
Risk analysis likelihood and impact: Security+ explained
Risk is a combination of how likely a threat event is and how much harm it would cause. Likelihood itself has two parts: the chance the event is initiated or occurs, and the chance that it then causes harm. Quantitative analysis uses real numbers and best supports cost-benefit choices; qualitative analysis uses levels such as low, moderate and high and suits early, uncertain assessments.
Likelihood and impact
NIST SP 800-30 Rev. 1 describes risk as typically a function of the adverse impacts that would arise if an event occurs and the likelihood of that event occurring. A risk assessment determines each factor, then combines them into a level of risk.
Overall likelihood is found in three steps. First, assess how likely the threat event is to be initiated (for an attacker) or to occur (for an accident or natural event). Second, assess how likely it is, once started, to cause adverse impact. Third, combine the two.
Daily probes that almost never cause harm lower the second part, so overall likelihood falls. The harm a successful attack would cause is unchanged, so impact stays the same.
Predisposing conditions
A predisposing condition is something about the organization, system or environment that raises or lowers the likelihood that a threat event causes harm. SP 800-30 gives two examples: a facility in a flood-prone region raises the likelihood of exposure to floods, and a stand-alone system with no external network connection lowers the likelihood of exposure to network attacks.
Likelihood is also judged against the safeguards already planned or in place. A company that already filters email and uses multifactor authentication should count those controls when it rates phishing.
Quantitative, qualitative and semi-quantitative
Quantitative assessment uses numbers whose meaning and proportionality hold inside and outside the assessment. It is the type that best supports cost-benefit analysis of different risk responses. Its results can still need explanation of the assumptions behind them.
Qualitative assessment uses non-numeric levels such as very low, low, moderate, high and very high. It is good for communicating results to decision makers, but the small range of values makes ranking risks against each other harder. In an initial assessment, when threat and vulnerability information is nonspecific and highly uncertain, SP 800-30 says a qualitative assessment using only a few factors may be appropriate.
Semi-quantitative assessment uses bins or scales, such as 0-100 or 1-10, whose values have no meaning outside the assessment. A score of 95 can be read as very high while still allowing comparisons between scores.
Where the exam catches people
- Believing frequent attack attempts always mean high likelihood: if almost none would cause harm, the overall likelihood is lower.
- Believing a facility's flood-prone location raises impact: SP 800-30 treats it as a predisposing condition that raises likelihood.
- Believing quantitative analysis is always the right choice: with vague, uncertain early information, a qualitative assessment may be more appropriate.
- Believing semi-quantitative scores are true quantities: their values and meanings do not carry outside the assessment.
- Believing likelihood is rated as if no controls exist: safeguards already planned or in place are part of the likelihood judgement.