Risk assessment methodologies in Cybersecurity - Step-by-Step Execution

Concept Flow - Risk assessment methodologies

Identify Assets

↓

Identify Threats

↓

Identify Vulnerabilities

↓

Analyze Risks

↓

Evaluate Risks

↓

Decide on Controls

↓

Monitor and Review

The flow shows the step-by-step process of assessing risks by identifying assets, threats, vulnerabilities, analyzing and evaluating risks, deciding controls, and then monitoring.

Execution Sample

Cybersecurity

Assets = ['Server', 'Database']
Threats = ['Malware', 'Phishing']
Vulnerabilities = ['Outdated software']
Risk = Threat_likelihood * Vulnerability_impact
if Risk > Threshold:
    Apply_controls()

This example shows how to identify assets, threats, vulnerabilities, calculate risk, and decide if controls are needed.

Analysis Table

Step	Action	Details	Result
1	Identify Assets	Server, Database	Assets listed
2	Identify Threats	Malware, Phishing	Threats listed
3	Identify Vulnerabilities	Outdated software	Vulnerabilities listed
4	Analyze Risks	Calculate risk for Malware on Server	Risk = Likelihood * Impact = 0.7 * 0.8 = 0.56
5	Evaluate Risks	Compare risk 0.56 to threshold 0.5	Risk is high
6	Decide on Controls	Apply patching and antivirus	Controls planned
7	Monitor and Review	Schedule regular checks	Ongoing process
8	End	All steps done	Risk assessment complete

💡 Process ends after monitoring and review step

State Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	After Step 4	After Step 5	After Step 6	Final
Assets	[]	['Server', 'Database']	['Server', 'Database']	['Server', 'Database']	['Server', 'Database']	['Server', 'Database']	['Server', 'Database']	['Server', 'Database']
Threats	[]	[]	['Malware', 'Phishing']	['Malware', 'Phishing']	['Malware', 'Phishing']	['Malware', 'Phishing']	['Malware', 'Phishing']	['Malware', 'Phishing']
Vulnerabilities	[]	[]	[]	['Outdated software']	['Outdated software']	['Outdated software']	['Outdated software']	['Outdated software']
Risk	N/A	N/A	N/A	N/A	0.56	0.56	0.56	0.56
Controls	None	None	None	None	None	Planned	Planned	Applied

Key Insights - 3 Insights

Why do we multiply threat likelihood by vulnerability impact to get risk?

Because risk depends on how likely a threat is and how badly it can affect the asset. Multiplying combines these two factors to estimate risk level, as shown in step 4 of the execution_table.

What happens if the risk is below the threshold?

If risk is below the threshold, controls may not be needed immediately. Step 5 shows comparing risk to threshold to decide if action is required.

Why is monitoring and review important after applying controls?

Because risks and environments change over time. Monitoring ensures controls remain effective, as shown in step 7 where ongoing checks are scheduled.

Visual Quiz - 3 Questions

Look at the execution_table at step 4, what is the calculated risk value?

A 0.7

B 0.56

C 0.8

D 1.5

💡 Hint

Check the 'Result' column in step 4 of the execution_table.

At which step does the risk get compared to the threshold?

A Step 3

B Step 6

C Step 5

D Step 7

💡 Hint

Look at the 'Action' column for the step where evaluation happens.

If the vulnerability was fixed before step 4, how would the risk value change?

A Risk would decrease

B Risk would stay the same

C Risk would increase

D Risk would be zero

💡 Hint

Refer to variable_tracker for Vulnerabilities and Risk values.

Concept Snapshot

Risk assessment steps:
1. Identify assets, threats, vulnerabilities
2. Calculate risk = likelihood × impact
3. Compare risk to threshold
4. Decide controls if risk is high
5. Monitor and review regularly
Risk helps prioritize security efforts.

Full Transcript

Risk assessment methodologies involve identifying what you want to protect (assets), what can harm them (threats), and weaknesses that can be exploited (vulnerabilities). Then, you calculate risk by combining how likely a threat is and how much damage it can cause. If the risk is above a set limit, you decide on controls to reduce it. Finally, you keep checking to make sure controls work and risks stay low. This process helps keep systems safe by focusing on the biggest dangers first.