Our security vendor just conducted a Risk Assessment for our organisation and has provided us with the report. One of the 'Threats' identified by the vendor is 'Theft', and our 4 office locations have been listed among the assets under the type 'Physical Location'.

In the final report, the probability and frequency of Theft have been given the value of 1 each for our 4 offices. I found it strange that the theft of a physical location is marked as probable, even though the value assigned to that threat is 1 (least probably on a scale of 1-3).

Initially, I assumed the probability has been marked for theft of devices, equipment, or IP by an insider, but those things were identified as different assets and have their own risk estimated for Theft.

My questions are:

1) Is it an industry practice that 'Theft of a physical location' to be given the least value of probability?

2) Is it acceptable in a Risk Assessment to assign a value of zero for the probability of threats like this?

What am I missing?

  • I don't understand the rating numbers, so I will use natural language: the probability of device theft is high for mobile devices (think airport) and low for equipment inside facilities. The level of protection of that facility and the devices (Kensington locks) determine thenprobability of theft on that location. I can hardly imagine a scenario where the probability is 0, not even in locked down data centers. – eckes May 24 '17 at 11:28
  • 1
    Are the offices in a fixed building? On a ship? On trailers? – schroeder May 24 '17 at 11:53
  • Offices are in a fixed building in an IT campus. – Citylight May 24 '17 at 11:56
  • 1
    @Sreeraj I have to see this report (I know that I can't) ... from what you've described, it's worthy of being framed ... – schroeder May 24 '17 at 12:05

Risk Assessment scales are typically qualitative in nature; they are "best guesses". From this perspective, you can never rate the probability of an event as 0, because that becomes a quantitative measure of certainty. So, even the most unlikely event is rated above 0. In a 3-point scale, that is 1.

So, to answer your second question, no, you will not see a 0 on a risk assessment.

But, seriously, theft of a building? Normally, things so unlikely to happen, or things if they did happen would pose a much greater risk in other areas, are deemed out-of-scope.

Technically, there is a minute chance that Martians could fly down and steal your office, so if the theft of your office is in scope, it would be rated a 1, but it should not be in scope. I'd challenge the report preparer why such an event was deemed in-scope....

  • Instead of zero, is it acceptable to mark is as Not applicable? – Citylight May 24 '17 at 11:58
  • Yes, that basically means that it is out-of-scope. – schroeder May 24 '17 at 12:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.