Risk Graphs and tools

Question 1

What are the three kinds of Threat Trees?

Answer 1

1) Asset Tree-asset, means of access, internal or external threat actor, intentional or unintentional motive, capability, event, consequence
2) Threat type tree-Type of threat, act, resultant effect, consequence
3) Adversary tree-adversary type, motivation, capability, methods, event, consequences.

Question 2

Picture the Risk Toleration Funnel, How is it used?

Answer 2

It is used to filter risks.

Question 3

Picture a risk frontier Graph. How is it used?

Answer 3

It is used to determine if it is more effective to reduce the potential loss/seriousness of consequence or decrease the likelihood of the risk occurring to achieve the desired “Acceptable Risk” frontier.

Question 4

Picture the Level of Risk Analysis Flowchart.

Answer 4

xxx

Question 5

What is the main drawback to automated tools?

Answer 5

They are not good at assessing intangible factors.

Question 6

What is an event Tree?

Answer 6

A tree that traces an initiating event through a sequence with different possible outcomes. Uses inductive logic to infer results.

Question 7

What is a Fault Tree?

Answer 7

Often used with Event trees to determine the base causes of an event.