What is a security risk?
A security risk is the chance that a threat harms an asset, together with how bad that harm would be. Rating risks lets you fix the worst ones first.
A small business cannot fix everything. A risk table tells it where the next hour and the next pound should go.
By the end of this lesson
Note
I can rate a risk by its likelihood and its impact.
Key words
| Word | What it means |
|---|---|
| Risk | the chance of harm, and how bad it would be |
| Likelihood | how likely a harm is, from 1 to 5 |
| Impact | how bad the harm would be, from 1 to 5 |
| Risk score | likelihood multiplied by impact |
| Control | a step that lowers a risk |
| Risk register | a table of risks, scores and decisions |
The cells students fill in are left blank in this preview.
A risk score is likelihood times impact
Give each risk two numbers from 1 to 5. Likelihood is how likely the harm is. Impact is how bad it would be.
Multiply them. The answer is the risk score, from 1 to 25. A big score means fix it soon.
The numbers are judgements, not measurements. Agree the meaning of each step with the people who share the table.
Worked example: a small risk register
| Risk | Likelihood | Impact | Score |
|---|---|---|---|
| Weak password on the admin account | 4 | 5 | 20 |
| A disk fails and there is no backup | 2 | 5 | 10 |
| The office printer jams | 5 | 1 | 5 |
| A visitor reads a screen over a shoulder | 3 | 2 | 6 |
The cells students fill in are left blank in this preview.
Let the shell multiply: likelihood 4, impact 5
echo $((4 * 5))Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Likelihood 2, impact 5
echo $((2 * 5))Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Bands turn a score into a decision
A score alone does not say what to do. Most teams group scores into bands.
In this lesson, 15 or more is high, 8 to 14 is medium and 7 or less is low. High risks get a control now. Medium risks get a plan. Low risks are watched.
Other teams choose other bands. What matters is that everyone uses the same ones.
Worked example: bands and what they mean
| Score | Band | What the team does |
|---|---|---|
| 15 to 25 | High | Add a control this week |
| 8 to 14 | Medium | Plan a control and set a date |
| 1 to 7 | Low | Write it down and watch it |
The cells students fill in are left blank in this preview.
An asset to rate: the lab's shared folder
stat -c "%a %U %G" /srv/projectsShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Rate the folder before you change anything
On a fresh lab machine the command prints 755 root root. Every user can read what is stored there. If you have already changed the folder, you will see your own settings.
Imagine the folder holds a team's project notes. Is reading by every user likely? What would it cost? Write your two numbers down, then multiply.
A common mistake
Warning
Many people think a rare event can be ignored. Likelihood alone does not decide. A disk failure is unlikely in a given month, but with no backup it costs everything, so it scores 10. A jammed printer is common and scores 5. Always multiply both numbers.
Four responses to a risk
Once a risk is rated, the team chooses a response.
To reduce it, add a control. To avoid it, stop the risky activity. To share it, move part of the cost, for example with insurance. To accept it, decide to live with it and write down why.
Going further
Write a risk register of five risks for your own laptop. Give each a likelihood, an impact, a score and a band.
Then add one control to the top risk and score it again. Which number moved, the likelihood or the impact?