Quantitative Risk Assessments

Question 1

What is Quantitative Risk Assessments?

Answer 1

Based on numeric values.
Asset value (AV)
Exposure factor (EF) - percentage of asset value loss when negative incident occurs.

Question 2

What is Single Loss Expectancy (SLE)?

Answer 2

How much loss is experienced during one negative incident? Multiply asset value (AV) by the exposure factor (EF)

Asset value (AV) = $24,000
Exposure factor (EF) = 12.5%
$24,000 (AV) * 0,125 (EF)= $3,000 (SLE)

Question 3

Quantitative Risk Assessment

Answer 3

Annualized Rate of Occurrence (ARO) - expected number of yearly occurrences. Example: 2-3 times per year.

Annualized Loss Expectancy (ALE) - total yearly cost of bad things happening. ALE=SLE x ARO

Question 4

Qualitative Risk Assessments

Answer 4

Based on subjective opinions regarding: *threat likelihood
*impact of realized threat.
Threats are given a severity rating.

Question 5

What is Risk Register?

Answer 5

Organizations should have one (or more)

Centralized list risks, severities, responsibilities, and mitigations.

Generally considered qualitative. - example: severity or impact ratings * occasionally includes hard numbers (%,$)

Question 6

What is a Risk Heat Map?

Answer 6

Take risk severity levels and map visually by color.

Question 7

What is a Risk Matrix?

Answer 7

Table of risk details similar to a heat map but without colors.