Open FAIR Foundation flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

FAIR risk definition

Risk is the probable frequency and probable magnitude of future loss. A valid risk statement specifies a loss event, an asset or stakeholder, and an expected loss magnitude over a defined time period.

Risk taxonomy top level

The FAIR ontology splits risk into Loss Event Frequency and Loss Magnitude. Each branch is further decomposed into measurable factors so analysts can estimate the components separately rather than guessing an overall risk number.

Loss Event Frequency (LEF)

The probable frequency, within a given timeframe, that a threat agent will inflict harm on an asset. LEF is the product of Threat Event Frequency and Vulnerability and is expressed as a distribution of events per year.

Threat Event Frequency (TEF)

The probable frequency that a threat agent acts against an asset in a way that could cause harm. TEF equals Contact Frequency multiplied by Probability of Action and is not the same as the frequency of actual losses.

Contact Frequency

The probable frequency of a threat agent coming into contact with the asset or with information about it. Contact can be physical, network-based, or through insiders and third parties, and it bounds the maximum plausible TEF.

Probability of Action

The probability that a threat agent will actually act against an asset once contact occurs. It reflects adversary intent, perceived value of the asset, and effort or risk to the attacker.

Vulnerability (FAIR)

The probability that a threat event becomes a loss event. It is derived by comparing Threat Capability, the force an agent can apply, against Resistance Strength, the defensive capability of the asset and its controls.

Threat Capability

The level of force a threat agent can apply against an asset, expressed as a distribution. Capability varies by agent type, such as nation-state, organized crime, insider, or opportunistic attacker.

Resistance Strength

The strength of controls protecting an asset, expressed as a distribution of the force required to overcome them. Resistance Strength is compared against Threat Capability to derive Vulnerability.

Loss Magnitude (LM)

The probable loss resulting from a single loss event, expressed as a distribution. LM equals Primary Loss plus Secondary Loss and is estimated per event, not per year.

Primary Loss

Losses that fall directly on the asset owner or business unit experiencing the event. Primary Loss comprises Productivity Loss, Response Loss, and Replacement Loss.

Secondary Loss

Losses that fall on secondary stakeholders such as customers, regulators, and shareholders. It includes Secondary Response Loss, Fines and Judgments, Competitive Advantage Loss, and Reputation Loss.

Productivity Loss

A primary loss component measuring the value of lost work time caused by an event. It is often estimated as the number of affected staff times hours lost times loaded labor rate.

Response Loss

A primary loss component covering the internal cost of investigating and responding to an event, such as incident response labor, forensics, and management attention.

Replacement Loss

A primary loss component capturing the cost to replace or restore an asset, including hardware, data, and intellectual property, and any temporary substitute capacity needed.

Secondary Response Loss

A secondary loss component covering the cost of responding to secondary stakeholders, such as customer notification, credit monitoring, legal defense, and public relations after an event.

Fines and Judgments

A secondary loss component representing regulatory penalties, contractual penalties, and litigation settlements resulting from a loss event. It is often estimated with legal and compliance input.

Competitive Advantage Loss

A secondary loss component measuring the value of intellectual property or market position lost when an event exposes trade secrets or strategic data to competitors.

Reputation Loss

A secondary loss component reflecting reduced goodwill, customer churn, and revenue decline after a publicly known event. It is often estimated through churn and revenue impact models.

Risk analysis stages

Open FAIR prescribes four stages: identify scenario components, analyze factor frequencies, analyze factor magnitudes, and derive and communicate risk. Each stage has defined inputs and outputs.

Scenario identification

The first analysis stage, defining the asset, threat community, loss event, timeframe, and stakeholder whose loss is being estimated. A vague scenario produces unusable factor estimates.

Frequency analysis stage

The second stage, estimating Contact Frequency, Probability of Action, Threat Capability, and Resistance Strength. These inputs yield Threat Event Frequency and Vulnerability, and then Loss Event Frequency.

Magnitude analysis stage

The third stage, estimating the six loss forms for Primary and Secondary Loss, producing a Loss Magnitude distribution per event. It uses business data such as labor rates and revenue figures.

Risk derivation stage

The final stage, combining Loss Event Frequency and Loss Magnitude into an annualized loss distribution. Results are reported as exceedance curves and compared with risk appetite.

Lognormal distribution use

FAIR commonly models frequency and magnitude factors as lognormal distributions because losses are non-negative and right-skewed. The distribution is described by a most likely value and a range.

PERT distribution use

A three-point distribution defined by minimum, most likely, and maximum values. It is used in FAIR for factors where subject-matter experts can supply plausible bounds and a mode.

Monte Carlo simulation

A method that repeatedly samples factor distributions to produce a loss exposure distribution. Open FAIR tools use it to compute annualized loss and percentiles such as the 90th.

Annualized Loss Exposure (ALE)

The distribution of total loss per year for a scenario, formed by combining Loss Event Frequency with Loss Magnitude. ALE is reported as a distribution, not a single number.

Exceedance curve

A plot showing the probability that annualized loss will exceed a given amount. It communicates risk in decision-ready form and allows comparison with risk tolerance thresholds.

Risk appetite vs tolerance

Risk appetite is the amount of risk an organization is willing to accept in pursuit of objectives. Risk tolerance is the acceptable variation around that appetite used to trigger action.

SME calibration

A technique for eliciting expert estimates by asking probability questions with known answers. Calibrated subject-matter experts give more reliable ranges for FAIR factor inputs.

Risk vs uncertainty

In FAIR, risk is measurable as probable frequency and magnitude, while uncertainty is expressed by the breadth of the distributions. Wider ranges signal weaker knowledge, not necessarily higher risk.