The document discusses risk assessment and outlines the process of assigning risk ratings to information assets. It describes how likelihood is estimated based on factors like historical data and organization attributes. It then discusses identifying possible controls and documenting the results of the risk assessment process in a worksheet that lists assets, vulnerabilities, and calculated risk-rating factors.

1. Risk Assessment
• assigns a risk rating or score to
each information asset.

3. Likelihood
Is the probability that a specific
vulnerability will be the object
of a successful attack.

4. Many asset/vulnerability combinations have
sources for likelihood, for example:
• The likelihood of a fire has been estimated actuarially for
each type of structure.
• The likelihood that any given e-mail contains a virus or
worm has been researched.
• The number of network attacks can be forecast based
on how many assigned network addresses the
organization has.

5. Risk
Determination

7. Identify Possibl
Controls

8. Three general categories
of control:

9. Three general categories of control:
1. Policies
General Security Policy
Program Security Policy
Issue – Specific Policy
System – Specific Policy

10. 2. Programs
3. Technologies

11. Documenting the Resu
of Risk Assessment

12. The worksheet shown in Table 4-9 is organized as follow
• Asset: List each vulnerable asset.
• Asset Impact: Show the results for this asset from
the weighted factor analysis worksheet. In the
example, this is a number from 1 to 100.

13. The worksheet shown in Table 4-9 is organized as follow
• Vulnerability: List each uncontrolled vulnerability by a threat
agent, as noted in the vulnerability analysis step. In the example,
the number is from 0.1 to 1.0.
• Risk-Rating Factor: Enter the figure calculated from the asset
impact multiplied by likelihood. In the example, the calculation
yields a number from 1 to 100.