Open FAIR Foundation case studies
Open FAIR Foundation · Put your knowledge to work in context.
The Open FAIR Foundation credential is a knowledge-based certification in risk analysis offered within The Open Group's Open FAIR certification portfolio, which the source describes as "Risk Analysis - Open FAIR™ Certification." It is aimed at professionals who need to understand and communicate risk in quantitative, business-relevant terms - risk analysts, security and IT risk managers, architects, and consultants who support decision-makers. The exam tests comprehension of the Open FAIR body of knowledge: how risk is defined and scoped, how loss event frequency and loss magnitude combine into risk, and how analysis results are normalized so they can be compared and used consistently across an organization. The Open FAIR Foundation case studies are 5 cases and about 4,449 words.
1Northbank: Which Number Is the Threat Event Frequency?
At Northbank, the fraud and security teams reconstructed twelve months of phishing data for the online banking platform. The secure email gateway blocked 11,520 messages; 480 reached employee inboxes; 96 recipients clicked the link; 31 submitted credentials on the lookalike page; 14 of those credentials were used through a real-time proxy to defeat SMS one-time passcodes; 9 sessions were used to attempt fraudulent transfers; 4 transfers cleared, totalling 310,000.
939 words, about 5 min2Lakeshore Outfitters: Six Loss Forms Without Double Counting
Lakeshore Outfitters, annual revenue 180M, completed a 14-month POS malware investigation covering 2.3 million payment cards. Finance and legal assembled the final cost schedule: external forensics 1.4M; internal IT overtime 600k; CEO and CFO time 250k; replacement of 1,800 terminals 900k; customer notification, call centre and mailing 700k; 24 months of credit monitoring 2.4M; card-brand fines and assessments 2.1M; plaintiff legal defence 1.1M; state attorney-general settlement 500k; and a 4.1% decline in online sales across two quarters, amounting to 3.7M of lost gross margin.
897 words, about 4 min3Meridian Health Plan: Scoping a Board Question in Six Weeks
Meridian Health Plan covers 3.2 million members. Its board has adopted a risk appetite statement: no single scenario may exceed 25M at the 90th percentile over a 12-month horizon.
873 words, about 4 min4Privileged Insider Exfiltration: Three SMEs, Three Different Questions
At a payments processor, the risk team is estimating the frequency of privileged-insider data exfiltration over the next 12 months. Three subject matter experts give 90% confidence intervals.
846 words, about 4 min5Harborline Logistics: MFA, Backups, or MDR?
Harborline Logistics has completed a FAIR analysis of a ransomware scenario on its warehouse-management platform. Threat event frequency is estimated at 6 campaigns per year and vulnerability at 0.30.
894 words, about 4 min