IIBA CCA cheat sheet

Cybersecurity Analysis

• Cybersecurity analysis is the practice of identifying, evaluating, and prioritizing risks to information assets so that security decisions align with business objectives; it produces findings that feed risk treatment, architecture, and control selection.

• Core analytical sequence: establish asset and data inventory, identify threats and threat actors, enumerate vulnerabilities, assess likelihood and impact, then derive risk exposure and recommend treatment (mitigate, transfer, avoid, accept).

• Qualitative risk rating commonly uses a matrix mapping likelihood (rare to almost certain) against impact (negligible to severe); semi-quantitative scoring multiplies ordinal likelihood and impact values to rank findings, and results must be documented with rationale.

• Quantitative risk measures use single loss expectancy (SLE = asset value x exposure factor) and annualized loss expectancy (ALE = SLE x annualized rate of occurrence); ALE comparisons support cost-benefit justification for controls.

• Defense in depth layers preventive, detective, and corrective controls across people, process, and technology; a control gap analysis maps existing controls to a chosen framework and flags uncovered risks rather than assuming coverage.

• Threat modeling identifies trust boundaries, entry points, assets, and adversary capabilities before design is finalized; STRIDE (spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege) provides a structured prompt for abuse cases.

• Vulnerability analysis distinguishes a vulnerability (weakness), a threat (potential cause of harm), and risk (likelihood-weighted impact); a finding is only actionable when it is tied to an asset, a credible threat, and a business consequence.

• Security monitoring analysis correlates logs, alerts, and indicators of compromise against baselines; false positive and false negative rates determine detection quality, and tuning is driven by measured signal-to-noise rather than alert volume alone.

• Business impact analysis establishes recovery time objective (RTO) and recovery point objective (RPO) per process; these objectives constrain continuity and resilience recommendations and take precedence over purely technical severity rankings.