Risk Identification, Monitoring and Analysis
Risk, monitoring and the numbers
Risk management starts with identification: assets, threats, vulnerabilities, and the resulting risk. Qualitative assessment (high/medium/low, matrices) is fast and subjective. Quantitative assessment produces money figures: asset value (AV), exposure factor (EF), single loss expectancy SLE = AV x EF, and annualized loss expectancy ALE = SLE x ARO.
Responses to risk: mitigate (apply a control), transfer (insurance, contract), avoid (stop the activity), accept (documented, with senior sign-off). Acceptance must be an informed business decision, not an oversight.
Business impact analysis drives recovery targets: RTO, RPO and MTD. RPO is the tolerable data loss and dictates backup frequency; RTO is the time allowed to restore service.
Monitoring means establishing a baseline, then detecting deviations from it. Know the tools: vulnerability scanners find weaknesses but do not exploit them; penetration tests perform authorized exploitation; SIEM aggregates and correlates logs; IDS/IPS uses signature or anomaly detection; file integrity monitoring watches critical files; KRI/KPI reporting shows whether controls are working. Continuous monitoring beats point-in-time audits.
Trap: assuming a vulnerability scan and a pen test are interchangeable, or that a scan proves exploitability. Another trap: answering "transfer" when the organization simply keeps running the risk - that is acceptance. Buying insurance while still operating the system is transfer.
Worked example: a server worth $50,000 has a 25% exposure factor and floods occur twice a decade. SLE = $12,500; ARO = 0.2; ALE = $2,500. A control costing $1,800 per year is justified on ALE grounds.
Rule of thumb: if the question says "documented decision to keep the risk," answer acceptance, not mitigation.