RANGER GAMEZ

CompTIA Security+ (SY0-701) · chapter 22 of 27

Month 7: Putting a price on risk

In this chapter Objectives 5.2

  1. Identify, assess, analyze
  2. Register, appetite, strategies, BIA
  3. Chapter recap

Objective 5.2

Identify, assess, analyze

Identification and assessment types

Risk identification finds what could go wrong: threats, vulnerabilities and the assets at stake. Risk assessments can be ad hoc (for a specific event, like a new vendor), recurring (on a schedule, such as yearly), one-time (for a single project) or continuous (ongoing, automated monitoring of risk).

Qualitative vs quantitative

Qualitative analysis uses ratings like low/medium/high and a heat map of likelihood vs impact. Fast, but subjective. Quantitative analysis uses numbers and money. Probability is the measurable chance (often a percentage) that an event happens; likelihood is the same idea, often rated rather than measured. Impact is the harm if it happens.

A three by three qualitative risk heat map. Likelihood runs up the side from low to high, impact along the bottom from low to high. Cells are colored green at low likelihood and low impact, yellow in the middle, and red at high likelihood and high impact. An example dot, a warehouse flood, sits at medium likelihood and high impact.
Qualitative risk: likelihood x impact on a heat map.

Exam tip Exam tip: dollar values and formulas = quantitative. High/medium/low colors = qualitative.

The money formulas

Exposure factor (EF): the percentage of the asset's value lost in one event. Single loss expectancy (SLE) = asset value x EF. Annualized rate of occurrence (ARO): how many times a year it is expected (0.1 = once in ten years). Annualized loss expectancy (ALE) = SLE x ARO.

Warehouse flood
Asset value (AV)   $400,000
Exposure factor    25%
SLE = 400,000 x 0.25  = $100,000
ARO = once in 10 years = 0.1
ALE = 100,000 x 0.1   = $10,000 per year
The quantitative risk formulas with the warehouse flood example. Asset value 400,000 dollars times exposure factor 25 percent gives a single loss expectancy of 100,000 dollars. Single loss expectancy times the annualized rate of occurrence, 0.1 for once in ten years, gives an annualized loss expectancy of 10,000 dollars per year.
SLE = AV x EF; ALE = SLE x ARO.

Exam tip Trap: a control costing more per year than the ALE it removes is usually not worth it on cost alone.

Objective 5.2

Register, appetite, strategies, BIA

Risk register

The risk register is the central list of risks: description, likelihood, impact, owner, strategy and status. Risk owners are the people accountable for each risk. Key risk indicators (KRIs) are metrics that warn a risk is growing (number of unpatched critical systems). A risk threshold is the level at which a risk or KRI triggers action.

Tolerance and appetite

Risk appetite is how much risk the organization is willing to take on to pursue its goals. It can be expansionary (willing to take more risk for growth), conservative (prefers low risk) or neutral (balanced). Risk tolerance is the acceptable variation around that appetite for a specific risk: how far a risk can go before it is no longer acceptable.

Exam tip Memory trick: appetite = how much you want to eat overall; tolerance = how much more you can stomach before you must stop.

Risk management strategies

Four ways to treat a risk:

  • Transfer: shift the financial impact to someone else (insurance, outsourcing with contract terms).
  • Accept: knowingly live with it. Includes an exemption (formally released from a requirement) and an exception (approved, usually temporary deviation from a policy, with compensating controls).
  • Avoid: stop the activity that creates the risk.
  • Mitigate: add controls to reduce likelihood or impact.

Exam tip Trap: transferring a risk moves money, not accountability. A breach at an insured company is still that company's breach.

Risk reporting and business impact analysis

Risk reporting tells leadership the current risks, trends and decisions needed. A business impact analysis (BIA) measures what downtime costs and sets targets:

  • Recovery time objective (RTO): target time to get a system back after an outage.
  • Recovery point objective (RPO): maximum acceptable data loss, measured in time (back up at least that often).
  • Mean time to repair (MTTR): average time to fix a failed component.
  • Mean time between failures (MTBF): average running time between failures (reliability).

Exam tip Memory trick: RPO = Point in the past you roll back to (data). RTO = Time until you are running again.

Check yourself 1A store's POS server is worth $20,000. A power surge would destroy 50% of its value, and surges happen about twice a year. What is the ALE?

  1. $10,000
  2. $40,000
  3. $5,000
  4. $20,000
Show the answer

Answer: D. $20,000

SLE = $20,000 x 0.5 = $10,000. ALE = SLE x ARO = $10,000 x 2 = $20,000.

Practice it in Ranger's Cyber PatrolThe same lessons as a story, with drills, hands-on labs and mock exams. Free, in your browser.
Play free

CompTIA, A+, Network+, Security+ and Linux+ are trademarks of CompTIA, Inc. Ranger Gamez is not affiliated with or endorsed by CompTIA. The practice questions are written to the published exam objectives; they are not real exam questions.