2

I am reviewing NIST SP800-30 rev 1 and I am having a hard time understanding how they determine the distribution of values within the risk matrix. In the document, they define semi-qualitative values – I am assume that these values are used in the calculation – however, the calculations are not provided. I am trying to programmatically calculate the result.

Here is is an example straight from the guideline:

NIST SP800-30 r1 Risk Scale

NIST SP800-30 r1 Likelihood of Threat Impact

NIST SP800-30 r1 Likelihood of Threat Initiation

My attempt using [Likelihood of Initiation] * [Likelihood of Occurrence], This does not yield the same results based on the scales provided.

My Attempt

What is the correct formula to calculate this?

Improve this question
1

Although I dont use this particular metric I use something similar.

The only time I've seen differentiation from the table is using greater then (vs greater then or equal to). You are using the minimum values out of a range instead of a midpoint.

In the examples you have using 9 vs 8 for the high value should do it. Quantative values like this are really just estimates.

Improve this answer
1
  • Hi Tim, thank you for the answer. I am still not getting the same results that NIST published in the document. I know that qualitative risk analysis is highly subjective, but it seems that their must be some math involved in how they distribute values across the matrix. Otherwise, I don't understand the point of them using semi-quantitative values. – m3ta Jul 28 '14 at 17:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.