Open FAIR Risk Analysis Process and Method
What the domain tests
Process questions test the Open FAIR analysis workflow: scoping, factor modeling, calibration, simulation, analysis, and communication. The exam favors disciplined scoping over broad guessing.
Core method
- Define one scenario: asset + threat + effect + timeframe. Keep scope narrow enough to model credibly.
- Map the scenario to the ontology before estimating numbers.
- Calibrate inputs with subject-matter experts using probabilistic ranges, usually a 90% confidence interval, not a single guess.
- Run a Monte Carlo simulation; outputs are distributions, often shown as loss exceedance curves and percentiles.
- Test sensitivity: identify which factor drives results; document assumptions and data quality.
Worked example
DDoS scenario: TEF 90% CI 4-12 per year; vulnerability 20-40%; LM 90% CI $50k-$150k. Simulation gives median annual loss $450k and 90th percentile $1.2M. The decision compares the 90th percentile with risk tolerance, not only the mean. If tolerance is $800k, the scenario exceeds tolerance in the tail; treatment is justified even if the median looks acceptable.
Traps
Using point estimates and calling it FAIR; calibrating at 50% instead of 90%; mixing multiple assets or threats in one model; treating simulation output as exact; skipping sensitivity and assumptions; reporting only ALE when the decision depends on tail risk.