Please enable JavaScript.
Coggle requires JavaScript to display documents.
Risk Management (Asset Valuation (Asset categorization (Tangible?), Asset…
Risk Management
Asset Valuation
Important to first
Identify the asset
Asset categorization
Tangible?
Asset prioritization
Critical?
Threat modelling
Frameworks exist - e.g STRIDE
Threat Identification
Threat categorisation
Threat response
Risk Management
Risk Identification
Risk analysis
Qualitative Risk Analysis
Interview
Storyboarding
Delphi technique
squad average from anonymous expert panel
Quantative Risk Analysys
Asset Value
Exposure Factor
The extent of impact before control becomes effective - expressed as a percentage
Annual Rate of Occurrence
Probability / likelihood
Single loss expectancy
=Asset Value * Exposure Factor
Annual Loss Expectancy
=Single Loss Expectancy * Annual Rate of Occurrence
Risk Response
Risk
Inherent Risk
Comes with the nature of the business - e.g in shipping a ship may sink.
Residual Risk
The remaining accepted risk after controls and mitigations have been applied
Vulnerability Modelling
Identification
Analysis
categorisation - critical?
Databases
e.g. NIST CVE
Scanning -
e.g. Nessus