Risk Assessment Tools: A Primer

Performing a risk analysis, either at the logical or physical level in and around the information technology (IT) enterprise, is a complex and often confusing endeavor. Arriving at an accurate risk profile is equally difficult, but needed to identify one’s risk and subsequently manage or mitigate the threats and vulnerabilities that create the risk. However, the process of identifying, quantifying and associating risk to assets falls just short of rocket science for most people. There is an art (and science) to performing risk assessments, which may explain why so few organizations conduct them well, or at all. However, calculating risk is no different from programming an application to perform a prescribed function. Also, using incorrect threat and vulnerability assumptions to determine one’s risk profile and posture can be costly in terms of money and lives. The results of a risk assessment will never exceed the quality of the data used as input to the process. Programmers understand the concept of garbage in, garbage out (GIGO) and this universal truth applies to risk management equally, if not more. There are, however, software products that provide a methodology and structure to the entire risk analysis process. This article looks at these tools, creates a framework of understanding and provides insight into the world of automated risk analysis. To understand how a risk assessment tool can assist in the process of identifying and quantifying risk, it is important to first understand what a risk analysis is. It simply is the process of identifying the potential for possible harm to occur to a particular set of assets or processes and determining the impact. There are, of course, varying degrees of risk analysis, with each providing differing views of an organization’s risk posture. The two primary types of risk analysis processes are: • Qualitative—A simplified process of identifying the major threats to which an enterprise is exposed. For example, if one’s IT enterprise is located within “tornado alley,” there is an implied threat of a tornado occurring that could subsequently cause an impact to assets or processes. Further, if the assets or processes are located in a hardened facility, then the actual vulnerability to the threat of a tornado could be mitigated or dramatically reduced. Basically, one must qualify which risks are worth protecting against. This process is more intuitive and generally can be accomplished in an abbreviated fashion by answering three basic questions: 1) What could happen? 2) How likely is it to occur? 3) What is the impact? Qualitative answers to one or more of these questions usually can provide sufficient information to allocate resources and dollars to protect an enterprise’s assets or processes. More complex enterprises or those with limited budgets require a more advanced form of risk analysis. • Quantitative—Today’s risk management requires a direct correlation to the value of the assets that require protection. Organizations increasingly want to know what the cost/benefit is to protecting an asset or process. CFOs also want to know what the return on investment (ROI) is for investing in risk reduction/mitigation strategies. To find this information, an advanced risk analysis technique, known as a quantitative approach, is used to provide statistical insight to risk prediction and impact. This method requires that one establish a monetary value for the assets and processes, estimate the probability of a threat occurring, and determine the ROI for implementing safeguards to reduce the impact caused by that threat occurring. Using the previous example of an enterprise’s location in tornado alley, one would examine the threat further by researching the threat frequency to determine the probability of occurrence. So qualitatively one knows that an asset is worth US $1 million and that a tornado could occur at some point in the future. Now quantitatively it is determined through research that tornadoes only occur once every two years within the enterprise’s proximal risk zone. This yields an annualized frequency expectancy (AFE) of . 5. Additionally, because the asset is located in a hardened facility, the impact of a tornado would be less than 100 percent. For this example, a 20 percent loss will be assumed. Qualitatively and quantitatively, all the necessary data are available to produce a credible risk assessment statement. The results would be expressed in the following manner: