## 3 Security Evaluation Methodology for ICT Systems
### Risk Estimation
#### 3.4.3 Risk Aggregation  
While the risk identification phase focused on breaking down high-level system analysis into low-level tests, this phase reverses the process, aggregating risks from the test level back to the overall system security properties, as shown in Figure 3.  
(1) From tests to claims: The overall risk for each claim is calculated as \(Risk_{Claim}=Likelihood\times Impact\) using the typical formula from NIST [32]. However, to accurately reflect the complexity of system risks, the calculation is refined depending on the type of claim. While test-based claims do not have an established impact value, vulnerability claims related to NVD entries already have a recognized impact value that the methodology can use for the risk calculation. \begin{table}
\begin{tabular}{c c} \hline
**Value** & **Criteria** \\ \hline
0 & No discernible effect, no appreciable consequences \\ \hline
10 & The financial damage remains tolerable to the organization \\ \hline
100 & The resulting damage leads to substantial financial losses \\  & but does not threaten the existence of the organization \\ \hline
1000 & The financial damage threatens the existence of the organization \\ \hline \end{tabular}
\end{table} 
Table 4: Financial impact [33]. \begin{table}
\begin{tabular}{c c} \hline
**Value** & **Criteria** \\ \hline
0 & No injury \\ \hline
10 & Light and moderate injuries \\ \hline
100 & Severe and life-threatening injuries (survival probable) \\ \hline
1000 & Life-threatening injuries (survival uncertain), fatal injuries \\ \hline \end{tabular}
\end{table} 
Table 3: Safety impact [33]. \begin{table}
\begin{tabular}{c l} \hline
**Value** & **Criteria** \\ \hline
0 & No discernible effect \\ \hline
1 & Minor/Moderate \\ \hline
10 & Degradation or loss of secondary function (system still operable \\  & but comfort or convenience functions do not work or work at a \\  & reduced level of performance) \\ \cline{2-3}  & Degradation of a primary function (system still operates but at a \\  & derated performance) \\ \hline
100 & Degradation of a primary function (system still operates but at a \\  & derated performance) \\ \cline{2-3}  & Potential failure mode affects safe system operation with some \\  & warning or \\  & non-compliance with government regulation \\ \hline \end{tabular}
\end{table} 
Table 5: Operational impact metrics [33]. \begin{table}
\begin{tabular}{c l} \hline
**Value** & **Criteria** \\ \hline \multirow{4}{*}{0} & No discernible effects in relation to violations of privacy and legislation. \\ \cline{2-3}  & Privacy violations of a particular stakeholder, which may not lead to abuses \\  & (e.g., impersonation of a victim to perform actions with stolen identities is not acceptable). \\ \hline \multirow{4}{*}{1} & Violation of legislation without appreciable consequences for business \\  & operations and finance \\ \hline \multirow{4}{*}{10} & Privacy violations of a particular stakeholder leading to abuses and media \\  & coverage. \\ \cline{2-3}  & Violation of legislation with potential of consequences for business operations \\  & and finance (e.g. penalties, loss of market share, media coverage). \\ \hline \multirow{4}{*}{100} & Privacy violation of multiple stakeholders leading to abuses. This level of \\  & privacy violation may lead to extensive media coverage as well as severe \\  & consequences in terms of loss of market share, business operations, trust, \\  & reputation, and finance for manufacturers and providers. \\ \cline{2-3}  & Violation of legislation causing significant consequences for business \\  & operations and finance (e.g. huge financial penalties, loss of market share) as \\  & well as extensive media coverage. \\ \hline \end{tabular}
\end{table} 
Table 6: Privacy and legislation impact metrics [33].