Cyber-risk identification and analysis
Identify, analyze, evaluate
IT risk assessment has three phases. Identification builds the inventory: assets, processes, data flows, threats, vulnerabilities, and existing controls, often through risk scenarios ("who or what could exploit which vulnerability, and with what consequence?"). Analysis assigns likelihood and impact, qualitatively (scales, heat maps) or quantitatively (monetary loss, annualized loss expectancy). Evaluation compares the result against risk criteria so risks can be ranked, compared, and prioritized for response. The output is the risk register, recording the risk statement, owner, inherent and residual scores, controls, and treatment status.
Know the quantitative vocabulary: single loss expectancy equals asset value times exposure factor; annualized loss expectancy equals single loss expectancy times annualized rate of occurrence. Know that risk arises from threat, vulnerability, and impact together; a severe threat against a well-controlled asset may be low risk. Business impact analysis supplies impact data, and key risk indicators provide early warning between formal assessments.
Traps
Questions deliberately conflate inherent risk (before controls) with residual risk (after controls). Scoring a risk without saying which one is being asked for is the most common error. Another trap implies assessment is a one-time project: it must be repeated on a schedule and triggered by change. Do not assume quantitative is always superior; qualitative is appropriate when data is unavailable or the decision is comparative. A heat map is only as good as its defined scales, and subjectivity must be managed through calibration.
Rule of thumb
State the control baseline explicitly: inherent and residual estimates depend on what is included. If the question leaves it unclear, identify the assumption rather than silently infer one score.
Worked example. A server worth $200,000 has a 40% exposure factor against a specific failure, so single loss expectancy is $80,000. The event is expected twice a year, so annualized loss expectancy is $160,000: the figure used to justify spending on a control.
Risk Assessment and Security Auditing
This domain tests structured risk thinking and the discipline of evidence-based audit. Expect terminology questions plus at least one simple quantitative calculation.
Risk fundamentals
Risk combines the probability of an event with its consequence. Qualitatively, use likelihood × impact matrices. Quantitatively:
- SLE = Asset Value × Exposure Factor.
- ALE = SLE × Annualised Rate of Occurrence.
- A simple financial comparison considers annual control cost against the estimated ALE reduction. Mandatory duties, uncertainty, correlated losses and nonfinancial consequences can also affect the decision.
Treatment options are mitigate, transfer, avoid and accept (documented, owned, with a review date). Inherent risk is measured before controls; residual risk is what remains after them.
Controls and frameworks
Controls are preventive, detective or corrective, and administrative, technical or physical. Frameworks: ISO 31000 for risk principles, ISO 27005 for information-security risk, and the NIST RMF (prepare, categorise, select, implement, assess, authorise, monitor). Threat modelling with STRIDE - spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege - connects design decisions to risk.
Audit
Audit types: first-party (internal), second-party (supplier or customer), third-party (independent certification body). Independence is essential: an auditor must not audit work they performed. Evidence comes from interview, observation, document review and sampling. Findings are graded as major nonconformity, minor nonconformity, or observation/opportunity for improvement. A report states objective evidence, not opinion, and assigns corrective actions with owners and dates.
Worked example
A server room asset is worth ¥2,000,000 and a flood would destroy 40% of it, so SLE = ¥800,000. Floods occur roughly once in 20 years, so ARO = 0.05 and ALE = ¥40,000 per year. If a barrier were assumed to remove the entire modeled loss, a cost of 30,000 would give a 10,000 annual expected financial benefit. Partial risk reduction changes the result; a 60,000 cost exceeds the 40,000 modeled annual reduction but may still be required or supported by other relevant benefits.
Traps
- Confusing inherent and residual risk.
- Treating a vulnerability scan output as an audit.
- Using a return period directly as a probability without converting it (1 in 20 years = 0.05).
- Writing findings as opinions with no objective evidence attached.