FAIR Model Flashcards
Risk
Probable frequency and probable magnitude of future loss
Risk components
Frequency and Magnitude
Loss event frequency
How frequently a loss will materialize within a time frame
Threat event frequency
Amount of times in a year a threat will act on an asset.
will attack or attempt to attack
Vulnerability
Probability that threat events become loss events
Percent that will be successful.
Loss magnitude
Total money lost from each event.
Primary losses and secondary losses.
Loss flow
Chain of events related to losses from threat action to realization of secondary losses.
Two sections: Primary LE and Secondary LE
PSH
Primary stakeholder
Primary Stakeholder
(Your org)
Secondary stakeholders
Anybody that has an interest in your org that can cause harm. (Business partners, customers, regulators, etc.)
SSH
Secondary stakeholder
Primary loss magnitude
Primary stakeholder loss that occurs directly from an event.
Secondary loss
Fallout from an event.
Secondary loss frequency
Probability that secondary losses will materialize.
Usually 100% for large breaches.
Secondary loss magnitude
Loss from secondary stakeholder reaction to primary event.
Contact frequency
How frequently an attacker comes into contact with an asset. (in a timeframe)
Probability of action
Percentage of contact events that will become threat events based on a threat agents choice.
Threat capability
Probable level of force that a threat is capable of applying against an asset.
Capability, skills, and resources of threat actor
Resistance strength
Degree of difficulty faced by threat agent. (Percentage)
What question does the FAIR model help answer?
How much risk do we have from this scenario?
What are the components of a scenario?
Need a loss event
Asset
Threat
Effect the threat seeks to have on the asset.
(optional) Method/vector the threat will use.
Contact frequency x Probability of Action=
Threat event frequency
What is a conscience choice on the part of the threat to seek to harm an assets CIA?
Threat event
Three types of contact in Contact Frequency
Random
Regular
Intentional
Random contact
Tornados, bears, hurricanes,
Random contact can be reduced by
Moving away from an area where a threat is possible.
Regular contact
Contact events due to regular activity.
Can include regular contact by threat actors.
Intentional contact
Threat intentionally seeks a particular asset.
Scanning your websites instead of random scanning
Perceived value
Value of asset to the threat agent.
Perceived level of effort
If a threat action requires too large an investment of time or other resources, they may choose not to attack an asset with which they have come into contact
Perceived risk
Threat agent perception about risk of action.
Secondary stakeholders examples
Clients Regulators Media Shareholders Etc.
