•

–

–

* National Institute of Standards in Technology (NIST) SP800-30

Evaluation and

Assessment

Risk Mitigation

Risk Assessment

•

–

–

–

•

•

•

•

•–

Impact

Probability Low (10) Medium (50) High (100)

High (1.0)Low

10 x 1 = 10Medium

50 x 1 = 50High

100 x 1 = 100

Medium (0.5)Low

10 x .5 = 5Medium

50 x .5 = 25Medium

100 x .5 = 50

Low (0.1)Low

10 x .1 = 1Low

50 x .1 = 5Low

100 x .1 = 10

•

•

•

•

•

–

–

–

–

–

–

–

•

–

–

–

–

•

–

–

–

•

–

–

–

–

–

•

–

Threat Vulnerability Exploit

Terminated Employees User accounts for terminated employees thatare left enabled

Terminated employees gain access confidentialinformation

Fire orNegligent Employees

Fire suppression controls for data center left in uncontrolled areas

Data center fire suppression controls are activated accidentally or maliciously

Unauthorized Users Unprotected confidentialdocuments

Confidential information is exfiltrated

•

•

–

–

•

–

–

–

•

–

–

–

Level Definition

High The threat-source is highly motivated and sufficiently capable, and controls to prevent the vulnerability from being exercised are ineffective

Medium The threat-source is motivated and capable, but controls are in place that may impede successful exercise of the vulnerability

Low The threat-source lacks motivation or capability, or controls are in place to prevent, or at least significantly impede, the vulnerability from being exercised

•

–

–

–

•

Level Definition

High Exercise of the vulnerability (1) may result in the highly costly loss of tangible assets or resources; (2) may significantly violate, harm or impede the organization’s mission, reputation, or interest; or(3) may result in human death or serious injury

Medium Exercise of the vulnerability (1) may result in the costly loss of tangible assets or resources; (2) may violate, harm or impede the organization’s mission, reputation or interest; or (3) may result in human injury

Low Exercise of the vulnerability (1) may result in the loss of some tangible assets or resources; (2) may noticeably affect the organization’s mission, reputation or interest

•

–

–

–

•

–

–

–

•

–

–

–

–

–

–

•

•

–

–

–

–

* National Institute of Standards in Technology (NIST) SP800-30

RISK vs. REWARD

•

–

–

•

–

•

•

•

–

•

–

•

–

•

•

–

–

–

–

–

–

–

–

Evaluation & Assessment

Risk Mitigation

Risk Assessment