- Numerical analysis of asset value

- Financial metrics and models

- Subjective assessment of asset value

- Factors like brand reputation and market position

- Potential events that can cause harm

- Internal and external sources

- Weaknesses that can be exploited

- Systemic flaws and gaps in security

- Probability of a threat exploiting a vulnerability

- Risk assessment metrics

- Consequences of a threat materializing

- Financial, operational, and reputational damage

- Non-numerical assessment of risks

- Expert judgment and scenario analysis

- Numerical assessment of risks

- Statistical models and calculations

STRIDE

PASTA

DREAD

- Identification of vulnerabilities

- Simulated attacks to test defenses

- Annual Loss Expectancy formula

- SLE Single Loss Expectancy

- Exposure Asset exposure to risk

- ARO Annual Rate of Occurrence

- Eliminate the risk entirely

- Change plans to sidestep risks

- Shift the risk to another party

- Insurance and outsourcing

- Reduce the impact or likelihood of risks

Administrative Controls

Technical / Logical Controls

Physical Controls

- Acknowledge the risk without action

- Informed decision to live with the risk

1. Prepare

2. Categorize

3. Select

4. Implement

5. Assess

6. Authorize

7. Monitor

- International standard for risk management

- Principles and guidelines for effective risk management

- Framework for enterprise risk management

- Focus on governance and risk culture

- Framework for managing IT-related risks

- Aligns IT risk with business objectives