Security Risk Assessment and Management
Risk assessment decides where security effort and money go. The exam tests the distinction between threat, vulnerability and risk, the assessment method, the treatment hierarchy, and the discipline of recording owner and review date.
Core definitions
- Asset: what you are protecting - people, property, information, reputation, continuity.
- Threat: who or what could act against the asset, and their capability and intent.
- Vulnerability: the weakness that lets the threat succeed.
- Impact: consequence if it succeeds.
- Risk: the combination - commonly likelihood × consequence, with vulnerability and effectiveness of existing controls factored in.
The assessment cycle (ISO 31000 logic)
Establish context, identify risks, analyse them, evaluate against tolerance, treat them, then monitor, review and communicate. Treatment options, in order of preference: avoid the activity, reduce likelihood or impact, transfer (insurance, contract), or accept with a named owner. Keep risk as low as reasonably practicable.
A 5×5 likelihood-by-consequence matrix gives consistency; define what each score means in words so two assessors reach the same rating.
Worked example
An ATM in a busy market. Threats: robbery, card skimming, vandalism. Vulnerabilities: poor lighting, no camera covering the fascia, single attendant, no cash limits. Impact: injury, cash loss, reputational damage. Rating: robbery high (likely × major). Treatment: lighting and camera (reduce), anti-skimming device and tamper seals (reduce), cash limits and time-lock (reduce impact), insurance (transfer). Owner named, review in three months.
Traps
Calling a threat a risk; rating everything high so nothing is prioritised; ignoring the insider; writing a report with no owner, cost or review date.