## 8 Security and Privacy Risk Assessment
### Risk Assessment Approach  
There are three different risk assessment approaches--qualitative, quantitative and semi-quantitative. A qualitative assessment approach uses subjective values with a scale of qualifying attributes (e.g., Very Low, Low, Medium, High, Very High) to describe the  
\begin{table}
\begin{tabular}{c c c} \hline
**Task No.** & **Task Definition** & **Key Roles** \\ \hline
1 & Defining the scope & * Execitives, ** Management, \\  & & *** Assesser \\ \hline
2 & Risk analysis & Management, Assessor, *** Third-party \\  & & resource (if needed) \\ \hline
4 & Security and privacy risk evaluation & Execitives, Management, Assessor \\ \hline
5 & Security and privacy risk control & Management, Assessor, Third-party \\  & & resource (if needed) \\ \hline
7 & Evaluation of overall residual security & Assessor, Management, Third-party \\  & and privacy risk acceptability & resource (if needed) \\ \hline \end{tabular} \({}^{\star}\) Execitives: C-level executives of the organizations. ** Management: Product manager, Project manager, Team Lead, QA Lead. *** Assesser: Technical Lead, Software Architect, Product Owner, Senior Software Engineer, Senior QA Engineer. *** Third-party resource: Consultant, Penetration tester.  
\end{table}
Table 4: Team structure for implementing the proposed framework.  
impact and likelihood of potential consequences of threats and vulnerabilities. The value of the impact and likelihood depends on the experience, expertise and competence of the person conducting the risk assessment. The qualitative assessment approach is very easy and less time consuming to perform compared to quantitative and semi-qualitative approaches, as this approach does not require any special tools or methods.  
Quantitative risk assessments use a scale with numerical values based on a set of mathematical methods, rules and historical incident data. This approach is usually expressed in a monetary term which reflects the amount of money an organization may lose over a time period if the threat event occurs, or a vulnerability is exploited. The quality of the analysis depends on the accuracy of the numerical values, historical incident data and the validity of the methods used. A semi-quantitative risk assessment provides an intermediate level between the qualitative and quantitative risk assessment. To evaluate a security risk using a semi-quantitative approach, use bins (e.g., 0-4, 5-20, 21-79, 80-95, 96-100) and scales (e.g., 1-10) which will provide the textual evaluation of qualitative risk assessment and the numerical evaluation of quantitative risk assessment. The value of the bins and scales will help to communicate the risk to decision-makers as well as to perform a relative comparison of risk. This approach does not require the same level of skill, tools, mathematical methods and historical incident data as in quantitative risk assessment.  
All three approaches have advantages and disadvantages. Quantitative risk assessment requires historical data to determine the likelihood of a threat event occurring or a vulnerability being exploited. Historical data that is not recently updated may add additional error to the risk assessment. Furthermore, it is difficult to calculate the cost of organization reputational damage, loss of competitive advantage and harm to user health if any threat event occurs or a vulnerability is exploited. Due to these facts, the quantitative approach will not be appropriate in information security and privacy risk assessment. This framework will use qualitative and semi-quantitative assessment approaches for evaluating the risk.