Risk Tutorial

The least likely factor Trisha would include when defining inherent qualitative risk is Controls.

Why “Controls” is the LEAST Likely Factor

In risk management, inherent risk is defined as the level of risk that exists in the absence of any security measures, safeguards, or management actions. It represents the “raw” threat to an asset before you have applied any effort to reduce or mitigate it.

• Inherent vs. Residual: By definition, inherent risk ignores the existence of controls. Once you factor in the controls (their effectiveness, maturity, and coverage), you are no longer measuring inherent risk; you are measuring residual risk.

• The Logic: If you include “Controls” in your calculation, you are assessing how well the risk is managed, not how naturally dangerous the risk is to the organization.

Understanding the Other Factors

The other three factors are standard components used to calculate or describe inherent risk:

• Asset Valuation (AV): To determine the potential “damage,” you must first understand the value of the asset being threatened. If the asset is worthless, the inherent risk is effectively zero.

• Impact or Consequence: This measures the magnitude of the loss or harm that would occur if the threat were realized (e.g., financial loss, reputational damage, or operational downtime).

• Likelihood or Probability: This measures the chance of the threat event actually occurring. Inherent likelihood looks at the susceptibility of the asset to the threat without considering the protective barriers in place.

Note: A common formula used in risk assessment is:

$$\text{Inherent Risk}=\text{Threat}\times \text{Vulnerability}\times \text{Asset Value}$$

(Or sometimes expressed as $\text{Likelihood}\times \text{Impact}$). None of these variables require the presence of a control to be calculated.

Are you working on building a risk assessment matrix for your organization, and would you like to see how to transition from inherent risk scoring to residual risk scoring?

Mastering the Risk Management domain is the most critical step for passing the CISSP exam. In the (ISC)² mindset, security is not about “eliminating” risk, but about managing it to a level acceptable to the business.

Part 1: CISSP Risk Management Tutorial

1. Core Concepts

• Asset: Anything of value to the organization.

  ExamCollection

• Threat: A potential cause of an unwanted incident (e.g., hacker, flood).

  ExamCollection

• Vulnerability: A weakness in an asset or control (e.g., unpatched software, unlocked door).

  ExamCollection

• Risk: The probability that a threat will exploit a vulnerability.

  ExamCert

  • Inherent Risk: The risk level before any controls are applied.

    Cybernous

  • Residual Risk: The risk that remains after controls are applied.

    Nityananda – Medium

2. Risk Management Lifecycle

1. Identify: Find assets, threats, and vulnerabilities.

   Nityananda – Medium

2. Analyze: Determine the probability and impact of the risk (Quantitative or Qualitative).

3. Evaluate: Compare results against the organization’s Risk Appetite (what they are willing to accept).

4. Treat/Respond: Take action to manage the risk.

5. Monitor: Continuously review for changes in the threat landscape.

3. Risk Response Options (MATA)

• Mitigate: Implement controls to reduce the risk.

• Accept: Formally document and acknowledge the risk (usually for low risks).

  Tech Jacks Solutions

• Transfer: Shift the risk to a third party (e.g., insurance).

  Tech Jacks Solutions

• Avoid: Eliminate the activity causing the risk entirely.

  Tech Jacks Solutions

Part 2: Top 10 Risk Equations & Metrics

You must memorize these for the exam. Expect scenarios where you have to “calculate” the best control.

Part 3: Top 10 Practice Questions

1. A company spends $50k on a control. ALE before is $100k, ALE after is $20k. Is the control cost-effective?

• Answer: Yes. The benefit is $80k ($100k – $20k), which is greater than the $50k cost.

2. Which risk response involves buying cyber insurance?

• Answer: Transfer.

3. What is the goal of a Quantitative Risk Assessment?

• Answer: To assign objective, monetary values to risk components for management decision-making.

  Tech Jacks Solutions

4. What is the difference between “Due Care” and “Due Diligence”?

• Answer: Due Diligence is the research/planning (doing your homework); Due Care is the execution (doing what a prudent person would do).

5. If an asset is worth $1M and a fire causes a 50% loss, what is the SLE?

• Answer: $500k ($1M × 0.50).

6. Which term describes the probability of a risk occurring within a year?

• Answer: ARO (Annualized Rate of Occurrence).

  ExamCert

7. When should a company use “Risk Acceptance”?

• Answer: When the cost of mitigation exceeds the potential loss, or the risk falls within the defined risk appetite.

8. What is the main difference between BCP and DRP?

• Answer: BCP (Business Continuity Planning) focuses on keeping the business running; DRP (Disaster Recovery Planning) focuses on restoring IT systems/infrastructure.

  ExamCert

9. A threat agent exploits a weakness. What is the “weakness” called?

• Answer: Vulnerability.

10. You identify a critical risk but the cost to mitigate it is higher than the loss. What is the most appropriate next step?

• Answer: Evaluate if the risk can be transferred or if the organization is willing to accept the residual risk.