Security Risk Management and Threat Analysis
Domain 4 - Security Risk Management and Threat Analysis. This domain tests how you convert asset, threat, and vulnerability information into prioritized decisions: what risk exists, who owns it, which treatment is justified, and what residual risk remains.
Core rules
- Risk is a function of likelihood and consequence. A qualitative matrix must be calibrated so different assessors assign the same rating to the same facts.
- Threat analysis considers capability, intent, and opportunity. Insider threat requires separate treatment because access, knowledge, and trust bypass many perimeter controls.
- Vulnerability is a condition that allows a threat to succeed. Do not double-count a threat as a vulnerability or score the same condition twice.
- Treatment follows a hierarchy: avoid, reduce, transfer, or accept. Cost-benefit analysis should compare risk reduction with lifecycle cost, not just purchase price.
- Record residual risk in a risk register with owner, treatment, due date, and review cycle. Acceptance must be explicit and authorized.
Worked example
A loading dock has unsupervised overnight access and recurring pilferage. Likelihood is high; consequence is medium; the risk is high. Controls include badge access at the dock door, cycle counts, camera coverage at the staging area, and random vehicle inspections. Residual risk becomes medium-low and is accepted by the warehouse owner, with quarterly review. The reasoning ties each control to a specific vulnerability rather than adding generic security.
Traps
Producing a risk score without a decision; inconsistent matrix definitions; ignoring insider threat; and treating risk acceptance as a verbal, unowned act.