CybersecurityLesson 3 of 5 in the course Security management

Risk Assessment: Methods, Models, and Applications

5 flashcards · 5 quiz questions · 5 match pairs · 5 fill-in sentences · English

Save course
Lesson progress
0 / 5

Your progress is kept in this browser only.Sign up to save it

Summary

Risk assessment helps people and organizations anticipate harm and decide what to do about it. This lesson introduces its core purpose, key components, and role in risk management.

A risk assessment is an objective, structured evaluation of potential harm. It identifies hazards, considers how likely they are to occur, examines their consequences, and considers actions that could reduce those consequences.

All flashcards

What is risk assessment?
A structured evaluation that identifies hazards, considers likelihood and consequences, and examines ways to reduce harm.
What is a hazard?
A situation or event with the potential to harm people, assets, or the environment.
What does tolerable risk mean?
A risk understood and accepted in context; it is not necessarily harmless or nonexistent.
How is annualized loss expectancy (ALE) calculated?
ALE=SLE×AROALE = SLE \times ARO, where SLE is loss from one incident and ARO estimates annual occurrence frequency.
What is dynamic risk assessment?
Continuous assessment of changing risks during an incident so that control measures can be adjusted.

Quiz questions

  1. What is the main purpose of risk evaluation?Answer: To judge whether analyzed risks are tolerable and whether they should be reduced.
  2. Why can a nonlinear system be difficult to assess?Answer: Interactions among components can produce unpredictable responses and cascading effects.
  3. A security analyst estimates a single loss expectancy (SLE) of $5,000 and an annualized rate of occurrence (ARO) of 0.2. Under the ALE model, what is the annualized loss expectancy?Answer: $1,000 per year
  4. What distinguishes population risk from individual risk?Answer: Population risk accounts for the number of people exposed; individual risk does not.
  5. What does accepting a risk imply?Answer: A decision that the remaining risk is acceptable in context, not that harm is impossible.

Based on the Wikipedia article Risk assessment, licensed CC BY-SA 4.0. Adapted into a summary, flashcards and quizzes.

More in Cybersecurity

All Cybersecurity lessons
CybersecurityAccess Control: Policies, Models, Physical Systems, and Threats5 flashcards · 5 quiz questions · 4 gamesPlay free →CybersecurityAES: Structure, Round Operations, Security, and Validation5 flashcards · 5 quiz questions · 4 gamesPlay free →CybersecurityDenial-of-Service Attacks: Techniques, Defenses, and Context5 flashcards · 5 quiz questions · 4 gamesPlay free →CybersecurityCryptographic Hashes: Properties, Constructions, and Security Uses5 flashcards · 5 quiz questions · 4 gamesPlay free →CybersecurityThreat Modeling: Methods, Tools, and Applications5 flashcards · 5 quiz questions · 4 gamesPlay free →CybersecurityRole-Based Access Control: Core Rules, Extensions, and Trade-offs5 flashcards · 5 quiz questions · 4 gamesPlay free →