Threat and Risk Assessment
Core concepts
Risk assessment combines threat (intent and capability of an adversary), vulnerability (weakness in the asset or controls), and consequence (impact if realized). Risk is commonly framed as a function of likelihood and impact. Know the difference between threat assessment (who might attack and how) and vulnerability assessment (where the gaps are).
Frameworks and terms
Be comfortable with qualitative versus quantitative methods, risk matrices and their subjectivity, risk appetite/tolerance, residual risk after controls, and the hierarchy of controls (eliminate, reduce, transfer, accept). Understand CARVER (criticality, accessibility, recuperability, vulnerability, effect, recognizability) as a target-attractiveness tool.
Traps to watch
- Equating threat with risk: a high threat against a hardened, low-consequence asset may be low risk.
- Ignoring residual risk after mitigation.
- Treating a risk matrix score as objective precision - matrices are ordinal and subjective.
- Confusing risk transfer (insurance) with risk elimination.
Rule of thumb
State risk as a sentence: "Given [threat] exploiting [vulnerability], the [asset] could suffer [consequence], with [likelihood]." If you cannot fill every bracket, the assessment is incomplete.
Worked example
A credible group targets a warehouse (high threat), but the site has layered access control and low-value stock (low vulnerability, low consequence). Despite high threat, overall risk is low-to-moderate; the correct answer prioritizes threat and the other factors, not threat alone.