Guide for Conducting Risk Assessments
CHAPTER 2 > 2.3.3 Analysis Approaches

2.3.3 Analysis Approaches

Analysis approaches differ with respect to the orientation or starting point of the risk assessment,
level of detail in the assessment, and how risks due to similar threat scenarios are treated. An
analysis approach can be: (i) threat-oriented; (ii) asset/impact-oriented; or (iii) vulnerability-
oriented.30 A threat-oriented approach starts with the identification of threat sources and threat
events, and focuses on the development of threat scenarios; vulnerabilities are identified in the
context of threats, and for adversarial threats, impacts are identified based on adversary intent. An
asset/impact-oriented approach starts with the identification of impacts or consequences of
concern and critical assets, possibly using the results of a mission or business impact analyses31
and identifying threat events that could lead to and/or threat sources that could seek those impacts
or consequences. A vulnerability-oriented approach starts with a set of predisposing conditions or
exploitable weaknesses/deficiencies in organizational information systems or the environments in
which the systems operate, and identifies threat events that could exercise those vulnerabilities
together with possible consequences of vulnerabilities being exercised. Each analysis approach
takes into consideration the same risk factors, and thus entails the same set of risk assessment
activities, albeit in different order. Differences in the starting point of the risk assessment can
potentially bias the results, causing some risks not to be identified. Therefore, identification of
risks from a second orientation (e.g., complementing a threat-oriented analysis approach with an
asset/impact-oriented analysis approach) can improve the rigor and effectiveness of the analysis.
In addition to the orientation of the analysis approach, organizations can apply more rigorous
analysis techniques (e.g., graph-based analyses) to provide an effective way to account for the
many-to-many relationships between: (i) threat sources and threat events (i.e., a single threat
event can be caused by multiple threat sources and a single threat source can cause multiple threat
events); (ii) threat events and vulnerabilities (i.e., a single threat event can exploit multiple
vulnerabilities and a single vulnerability can be exploited by multiple threat events); and (iii)
threat events and impacts/assets (i.e., a single threat event can affect multiple assets or have
multiple impacts, and a single asset can be affected by multiple threat events).32 Rigorous analysis
approaches also provide a way to account for whether, in the time frame for which risks are
assessed, a specific adverse impact could occur (or a specific asset could be harmed) at most
once, or perhaps repeatedly, depending on the nature of the impacts and on how organizations
(including mission/business processes or information systems) recover from such adverse
impacts.
30 Organizations have great flexibility in choosing a particular analysis approach. The specific approach taken is driven
by different organizational considerations (e.g., the quality and quantity of information available with respect to threats,
vulnerabilities, and impacts/assets; the specific orientation carrying the highest priority for organizations; availability of
analysis tools emphasizing certain orientations; or a combination of the above).
31 A Business Impact Analysis (BIA) identifies high-value assets and adverse impacts with respect to the loss of
integrity or availability. DHS Federal Continuity Directive 2 provides guidance on BIAs at the organization and
mission/business process levels of the risk management hierarchy, respectively. NIST Special Publication 800-34
provides guidance on BIAs at the information system level of the risk management hierarchy.
32 For example, graph-based analysis techniques (e.g., functional dependency network analysis, attack tree analysis for
adversarial threats, fault tree analysis for other types of threats) provide ways to use specific threat events to generate
threat scenarios. Graph-based analysis techniques can also provide ways to account for situations in which one event
can change the likelihood of occurrence for another event. Attack and fault tree analyses, in particular, can generate
multiple threat scenarios that are nearly alike, for purposes of determining the levels of risk. With automated modeling
and simulation, large numbers of threat scenarios (e.g., attack/fault trees, traversals of functional dependency networks)
can be generated. Thus, graph-based analysis techniques include ways to restrict the analysis to define a reasonable
subset of all possible threat scenarios.