Risk Assessment Process

The previous nine courses did the same work: each counted which path a defense closed, which item it set aside, which duration it shortened, and wrote down the legitimate work it stopped in return. At the end of every course, what remained was a measured list of defenses. The one thing never asked was what these lists were relative to each other: which one gets done first, which one a scarce budget goes to, and how its completion is proven to whom.

This course ties those three questions to a measure, and its measure is ranking. The number of paths a defense closes does not by itself give a priority; priority only arises when it is compared against the other items standing in the same list. This lesson builds that list: the asset set, the threat set and the risk items that arise from their intersection. Risk being the combination of likelihood and impact was defined in the Introduction to Cybersecurity course; here that definition is the input, and the scale is not a single item but the program.

From Asset to Item

A risk item is not an asset by itself; “field laptop” is not a risk item but an asset class. An item arises from an asset being matched with a specific threat: malicious code on a field laptop is one item, physical access to the same machine is another. The two differ in frequency, impact, treatment path and cost. The assessment process therefore has three steps: classify the assets, mark which threats apply to each class, and write down the frequency and impact for every pair left at the intersection.

The set below is a model of the fictional regional measurement network: no real inventory is scanned, no real incident log is read, no real currency is used. All values are in fictional units.

• RM1. Ten asset classes, seven threat types and all coefficients are the model.
• RM2. The applicability mask is taken as derived from the job description and is fixed in the model. In reality this mask is filled in by an assessment exercise and changes as the role changes.
• RM3. Frequency is the product of the threat’s base frequency and the asset’s exposure coefficient; impact is the product of the asset class’s value and the threat’s impact multiplier.
• RM4. Every item has a single treatment option; its cost is the product of the threat’s base cost and the asset’s cost coefficient, and it reduces risk by a fixed ratio tied to the threat.
• RM5. Items are independent: treating one item does not change another item’s risk.
• RM6. The budget is spent in order; an item that does not fit is skipped, and the order is not disturbed.

// risk/list.mjs — this IS A MODEL of the fictional regional measurement network's risk items: there
// is no real inventory, no real incident log and no real currency; values are in "fictional units".

// RM1: threat row: name | annual base frequency | impact multiplier | treatment cost | reduction ratio
export const THREAT = `
  credential-theft     0.30  0.35  40  0.70
  malicious-code       0.50  0.25  30  0.60
  misconfiguration     0.80  0.15  12  0.75
  insider-misuse       0.10  0.40  55  0.40
  service-disruption   0.40  0.20  25  0.50
  physical-access      0.06  0.50  35  0.65
  supply-chain         0.08  0.45  60  0.30`
  .trim().split("\n").map((r) => {
    const [name, baseFreq, mult, cost, reduction] = r.trim().split(/\s+/);
    return { name, baseFreq: +baseFreq, mult: +mult, cost: +cost, reduction: +reduction };
  });

// RM2: asset row: name | count | class value | exposure coefficient | cost coefficient |
// threat mask (seven digits in THREAT order; 1 applicable, 0 not)
export const ASSET = `
  field-laptop            120   900  1.6  1.0  1111011
  branch-endpoint          40   600  1.2  1.0  1111110
  measurement-collector   300   750  1.4  1.5  0111110
  processing-server        12  1800  0.6  0.8  1111101
  perimeter-network         4  1200  1.8  0.6  0011100
  identity-directory        1  2400  1.0  0.7  1011100
  cloud-account             3  2000  1.5  1.4  1011100
  subscriber-database       1  3000  0.4  0.9  1011100
  field-application         1  1400  1.1  0.7  1111001
  supplier-connection       3  1000  1.3  1.2  1001101`
  .trim().split("\n").map((r) => {
    const [name, count, value, exposure, costMult, mask] = r.trim().split(/\s+/);
    return { name, count: +count, value: +value, exposure: +exposure, costMult: +costMult, mask };
  });

// RM3: an item is an applicable (asset, threat) pair. Frequency derives from the asset and the
// threat, impact derives from the asset's value; risk = frequency x impact (the previous course's
// definition, here it is input).
export const ITEM = [];
for (const v of ASSET)
  for (const [j, t] of THREAT.entries())
    if (v.mask[j] === "1") {
      const frequency = +(t.baseFreq * v.exposure).toFixed(3), impact = +(v.value * t.mult).toFixed(1);
      const risk = +(frequency * impact).toFixed(2), cost = +(t.cost * v.costMult).toFixed(1);
      // RM4: treatment reduces the item's risk by a ratio tied to the threat; the decrease
      // per unit of effort = risk reduced / cost spent.
      ITEM.push({ v, t, frequency, impact, risk, cost, reduction: t.reduction,
        decrease: +(risk * t.reduction).toFixed(2), ratio: +((risk * t.reduction) / cost).toFixed(3) });
    }

export const TOTAL = +ITEM.reduce((a, k) => a + k.risk, 0).toFixed(2);
// Ties keep the generation order (stable sort).
export const sortBy = (f) => ITEM.map((k, i) => ({ k, i }))
  .sort((a, b) => f(b.k) - f(a.k) || a.i - b.i).map((x) => x.k);
export const position = (L, k) => L.indexOf(k) + 1;

Counting the List

// risk/generate.mjs — the item list, program scale and the course's unit of measure from the pair set
import { ASSET, THREAT, ITEM, TOTAL, sortBy, position } from "./list.mjs";

const y = (g, ...s) => console.log(s.map((v, i) =>
  (g[i] < 0 ? String(v).padEnd(-g[i]) : String(v).padStart(g[i]))).join("").trimEnd());
const BY_RISK = sortBy((k) => k.risk);    // risk from largest to smallest
const BY_RATIO = sortBy((k) => k.ratio);  // decrease per unit of effort

console.log(`${ASSET.length} assets x ${THREAT.length} threats = ${ASSET.length * THREAT.length}` +
  ` possible pairs; applicable ${ITEM.length} items; total annual risk ${TOTAL} fictional units`);

const A = [-22, 6, 7, 10, 9, -22];
console.log("\n1. per asset");
y(A, "asset", "count", "items", "risk", "share %", "  largest item");
for (const v of ASSET) {
  const ks = ITEM.filter((k) => k.v === v);
  const top = ks.reduce((a, k) => (k.risk > a.risk ? k : a));
  y(A, v.name, v.count, ks.length, ks.reduce((a, k) => a + k.risk, 0).toFixed(2),
    ((ks.reduce((a, k) => a + k.risk, 0) / TOTAL) * 100).toFixed(1), "  " + top.t.name);
}

const B = [-22, -21, 10, 8, 9, 7, 7, 5, 5];
console.log("\n2. first ten items by risk order");
y(B, "asset", "threat", "frequency", "impact", "risk", "cost", "ratio", "R", "O");
for (const k of BY_RISK.slice(0, 10))
  y(B, k.v.name, k.t.name, k.frequency.toFixed(2), k.impact.toFixed(1), k.risk.toFixed(2),
    k.cost.toFixed(1), k.ratio.toFixed(3), position(BY_RISK, k), position(BY_RATIO, k));

const C = [-22, -21, 10, 8, 9, 7, 7, 5, 5];
console.log("\n3. first five items by ratio order");
y(C, "asset", "threat", "frequency", "impact", "risk", "cost", "ratio", "R", "O");
for (const k of BY_RATIO.slice(0, 5))
  y(C, k.v.name, k.t.name, k.frequency.toFixed(2), k.impact.toFixed(1), k.risk.toFixed(2),
    k.cost.toFixed(1), k.ratio.toFixed(3), position(BY_RISK, k), position(BY_RATIO, k));

const D = [-38, 6];
console.log("\n4. difference between the two rankings");
const shift = ITEM.map((k) => Math.abs(position(BY_RISK, k) - position(BY_RATIO, k)));
y(D, "items with a changed rank", shift.filter((x) => x > 0).length);
y(D, "largest rank shift", Math.max(...shift));
y(D, "shared items in the top ten", BY_RATIO.slice(0, 10).filter((k) => BY_RISK.slice(0, 10).includes(k)).length);
y(D, "ratio rank of the riskiest item", position(BY_RATIO, BY_RISK[0]));
y(D, "risk rank of the highest-ratio item", position(BY_RISK, BY_RATIO[0]));

const BUDGET = 200;
const E = [-14, 7, 10, 9, 12];
console.log(`\n5. spending a ${BUDGET}-unit budget according to the two rankings`);
y(E, "ranking", "item", "spent", "decrease", "remaining %");
const spend = (L) => L.reduce((s, k) => (s.h + k.cost > BUDGET ? s
  : { h: s.h + k.cost, a: s.a + k.decrease, n: s.n + 1 }), { h: 0, a: 0, n: 0 });
const [R, O] = [spend(BY_RISK), spend(BY_RATIO)];
for (const [name, s] of [["risk", R], ["ratio", O]])
  y(E, name, s.n, s.h.toFixed(1), s.a.toFixed(2), (((TOTAL - s.a) / TOTAL) * 100).toFixed(1));
console.log(`the ratio ranking gives ${(O.a - R.a).toFixed(2)} more units of decrease ` +
  `(${(((O.a - R.a) / R.a) * 100).toFixed(1)}%) and ${(R.h - O.h).toFixed(1)} fewer units of spending`);

10 assets x 7 threats = 70 possible pairs; applicable 47 items; total annual risk 5768.61 fictional units

1. per asset
asset                  count  items      risk  share %  largest item
field-laptop             120      6    656.64     11.4  malicious-code
branch-endpoint           40      6    360.00      6.2  malicious-code
measurement-collector    300      5    414.75      7.2  malicious-code
processing-server         12      6    546.48      9.5  malicious-code
perimeter-network          4      3    518.40      9.0  misconfiguration
identity-directory         1      4    828.00     14.4  misconfiguration
cloud-account              3      4   1035.00     17.9  misconfiguration
subscriber-database        1      4    414.00      7.2  misconfiguration
field-application          1      5    656.04     11.4  malicious-code
supplier-connection        3      4    339.30      5.9  credential-theft

2. first ten items by risk order
asset                 threat                frequency  impact     risk   cost  ratio    R    O
cloud-account         misconfiguration           1.20   300.0   360.00   16.8 16.071    1    4
cloud-account         credential-theft           0.45   700.0   315.00   56.0  3.938    2   15
identity-directory    misconfiguration           0.80   360.0   288.00    8.4 25.714    3    2
perimeter-network     misconfiguration           1.44   180.0   259.20    7.2 27.000    4    1
identity-directory    credential-theft           0.30   840.0   252.00   28.0  6.300    5    8
cloud-account         service-disruption         0.60   400.0   240.00   35.0  3.429    6   17
field-application     malicious-code             0.55   350.0   192.50   21.0  5.500    7   10
identity-directory    service-disruption         0.40   480.0   192.00   17.5  5.486    8   11
field-application     misconfiguration           0.88   210.0   184.80    8.4 16.500    9    3
field-laptop          malicious-code             0.80   225.0   180.00   30.0  3.600   10   16

3. first five items by ratio order
asset                 threat                frequency  impact     risk   cost  ratio    R    O
perimeter-network     misconfiguration           1.44   180.0   259.20    7.2 27.000    4    1
identity-directory    misconfiguration           0.80   360.0   288.00    8.4 25.714    3    2
field-application     misconfiguration           0.88   210.0   184.80    8.4 16.500    9    3
cloud-account         misconfiguration           1.20   300.0   360.00   16.8 16.071    1    4
field-laptop          misconfiguration           1.28   135.0   172.80   12.0 10.800   11    5

4. difference between the two rankings
items with a changed rank                 45
largest rank shift                        16
shared items in the top ten                6
ratio rank of the riskiest item            4
risk rank of the highest-ratio item        4

5. spending a 200-unit budget according to the two rankings
ranking          item     spent decrease remaining %
risk                9     198.3  1547.40        73.2
ratio              13     184.7  1787.40        69.0
the ratio ranking gives 240.00 more units of decrease (15.5%) and 13.6 fewer units of spending

The numbers are in the measurement class; its inputs are RM1–RM6.

The Filter Itself Is a Decision

The first line gives two numbers: 70 possible pairs and 47 applicable items. The 23 pairs in between never enter the list at all, because the applicability mask filters them out. The perimeter network has no credential theft marked against it, the measurement collector has no credential theft marked against it, the subscriber database has no malicious code marked against it. Each is a defensible decision, but none of them is a measured decision.

A filtered-out pair’s risk is not written as zero; it is not written at all. It does not appear in the ranking, it does not take up room in the budget, it has no share in the total. This is the quietest step of the assessment process: an item that is never added to the list stays outside every measurement that follows. If one of the 23 exclusions is wrong, that wrong decision appears in none of this lesson’s tables.

Count Is Not Risk

The first table gives the program scale’s first result. The measurement collector is the most numerous asset class with 300 units and carries 7.2 percent of the total risk. The cloud account has three units and carries 17.9 percent. The identity directory has one unit and carries 14.4 percent. Together the two classes account for a third of the program’s risk and take up four rows in the inventory.

The reason for this divergence is that value is carried by function, not by count. When one measurement collector goes down, a small part of the region cannot be read; when the identity directory goes down, every access decision goes down with it. A priority list built on count gives exactly the reverse order, and that is the easiest decision to make while the inventory sheet is open.

The second divergence is between the asset total and the item ranking. The field laptop is third in class total (656.64 units), but this class’s largest item only makes it to tenth place in the top ten. The class climbs up on the sum of six items, while each item on its own stays middling. In the opposite direction, the perimeter network carries only three items, and one of them is in fourth place. Treating an asset and treating an item are not the same job: the first means six separate pieces of work, the second means one.

The Course’s Unit of Measure

Every ranking so far has gone by the size of the risk itself and never asks one thing: how much effort it costs to reduce that risk. The item list’s fourth column writes this down. The risk decrease per unit of effort is the reduced risk divided by the cost spent, and it is this course’s unit of measure.

The second table’s last two columns place the two rankings side by side. The credential theft item on the cloud account is second in risk order and fifteenth in ratio order. Its risk is 315.00 units, but its treatment cost of 56.0 units is one of the six highest costs among the forty-seven items: changing the identity setup on three cloud accounts is both the broadest piece of work and one whose reduction ratio stays at 70 percent. Its neighbor at the same rank — misconfiguration on the identity directory — carries 288.00 units of risk and is treated for 8.4 units.

The fourth table counts the difference in aggregate. Across the same 47 items, 45 change rank, the largest shift is 16 places, and only six of the top ten are shared. The riskiest item drops to fourth place in ratio order, and the highest-ratio item drops to fourth place in risk order. Neither falls from the top of the list; the real shift happens in the middle band, and the middle band is where most of the budget gets spent.

When Ranking Turns Into Budget

The fifth table turns the difference into a decision. When a two-hundred-unit budget is spent in risk order, nine items are treated, 198.3 units are spent, and total risk drops by 1,547.40 units. When the same budget is spent in ratio order, thirteen items are treated, 184.7 units are spent, and risk drops by 1,787.40 units. The difference is 240.00 units, that is, 15.5 percent more decrease — and with 13.6 units less spending, too.

The risk ranking exhausting the budget on nine items is not a flaw; it is a consequence of the ranking’s own logic: the biggest risks are also the most expensive to treat, because both come from the same place — the asset’s centrality. When the priority list says “biggest first,” it ties the budget up in a small number of expensive items and never touches the remaining thirty-eight. This is the first case of the ranking putting the wrong item first, and its cost can be counted.

The third table writes down the ratio ranking’s own blind spot: all five of the top five items are the misconfiguration threat. The threat type with the lowest treatment cost entirely occupies the top of the list. When the program follows this order, it goes deep on a single threat type while the remaining risk piles up in the other six types. What both rankings leave behind is between 69 percent and 73 percent; the four-point difference between them is a real gain, but the real number is that the budget is not enough to finish the list.

Summary

• A risk item is not an asset but a pair of an asset and a threat; of the 70 pairs of ten assets and seven threats, 47 are applicable and carry a total annual risk of 5,768.61 fictional units.
• The 23 filtered-out pairs are not written as zero; they are not written at all. An item that never enters the list stays outside every ranking, budget and total that follows.
• Count and risk give different rankings: the 300-count class carries 7.2 percent, the three-count class carries 17.9 percent, and the one-count class carries 14.4 percent. The class that is third in asset total has its largest item reach only tenth place in the item ranking.
• The course’s unit of measure is the risk decrease per unit of effort; in the same list, 45 items change rank, the largest shift is 16 places, and six of the top ten stay shared.
• A two-hundred-unit budget gives nine items and a 1,547.40-unit decrease in risk order, and thirteen items and a 1,787.40-unit decrease in ratio order: a 240.00-unit difference, with 13.6 units less spending.
• The ratio ranking’s top five all come from a single threat type; both rankings leave between 69 and 73 percent of the risk unaddressed.

Next Step

Every number in this lesson rests on a single assumption: that frequency and impact are known numbers. Yet no row’s 0.80 frequency or 300.0 impact anywhere in the list came from a measurement; it came from an estimate. Most organizations therefore use two separate paths: qualitative scoring that places items into bands instead of numbers, or a monetary model that splits the loss into asset value and exposure ratio. The next lesson runs both paths on the same 47 items, calculates single-occurrence and annual loss expectations in fictional units, and answers a single question: how many rankings do the two methods write differently from the same data, and which items does it drop into ties.