How does one properly assess risk?

Question

Security is never 100%. There is a need to balance risk and cost. Risk assessments need to be performed to determine the cost-effectiveness of preventive measures.

There are a few questions I would like answered:

• What are the frameworks to follow when performing risk assessment?
• How does an organisation effectively model a threat?
• How does an organisation accurately determine the monetary cost of a potential security threat specific to their own current circumstances?

I don't think there are any questions here that covers this yet.

Please - no answers consisting of only links to outside resources. I would like one or two detailed answers covering an overview of how risk assessment is usually done in large organisations.

Answer 1

ISO/IEC 27005:2011 is the ISO standard providing guidelines for risk management and contains a lot of advice for the assessment part of that process. A ridiculously abbreviated summary might be:

• Identify the risk by:
  • identifying your assets
  • identifying the threats to each asset
  • identifying the existing controls protecting each asset
  • identifying the vulnerabilites in each asset that the threats might exploit
  • identifying the consequences of harm to each asset
• Analyse the risks by:
  • determining likelihood of harm (i.e. loss of Confidentiality, Integrity, or Availability)
  • determining the impact of harm
  • combining those values to assign a level of risk
• Evaluate the risk by comparing the level to your acceptable risk threshold

You would usually do the identification step by taking inventory of your assets and interviewing their owners and maintainers about them.

The analysis stage is usually qualitative and fairly simple. For example, you might assign values of Low, Medium, or High to both likelihood and impact of each risk, then have a simple table showing the consequent risk value. High likelihood and high impact means a high risk, and so on. This seems rather simplistic, but it's very hard to give precise quantitative values to likelihood and impact across all your risks. What's the likelihood that my office will burn down next week? Spock might estimate the probability as 2.457% but I'm human, so the best I can do is estimate it is "Very Low". Your circumstances may be different, of course.

Finally the evaluation stage is simply comparing the level of risk to what you find acceptable, to see if the risk needs treatment. Again, it's a little simplistic, but the reason you're doing analysis is to determine a) what risks you need to treat and b) what order to do them in.

Answer 2

I can't answer for large organizations, but for small organizations, I found the following risk assessment matrix is usually good enough to get the management to a) think about security and the possible implications of failure b) help them make decisions about the resouces/effort the can/need to invest.

+----------------+---------------------------+---------------------------+------------------+-------------------------------+
| What           | Current level of security | Improvement Effort Needed | Data Sensitivity | Impact of Worst Case Scenario |
+----------------+---------------------------+---------------------------+------------------+-------------------------------+
| Product Foo    | low                       | ++                        | -                |                               |
| - component a  | reasonable/good           | High                      | Medium           | Major                         |
| - component b  | very low!                 | Medium (requires time)    | Medium+          | Non acceptable                |
| - ...          | ...                       | ...                       | ...              | ...                           |
+----------------+---------------------------+---------------------------+------------------+-------------------------------+

The above matrix is quite simple and far from perfect, but it gets people to think about the problem and possible consequences, it is intuitive enough to be useful at several levels within the organisation, and serves as a basis to start prioritizing where to put effort.