Tutorial 6.4: Risk Assessment Methodologies and Frameworks

Learning Objectives

After completing this tutorial, you should be able to:

• Explain the purpose and scope of major risk assessment frameworks.
• Apply the NIST SP 800-30 risk assessment process to a given scenario.
• Compare and contrast ISO/IEC 27005, NIST SP 800-30, OCTAVE, and FAIR.
• Perform a risk assessment using asset-based approaches (OCTAVE) and threat-based approaches (NIST).
• Calculate risk using the FAIR model's loss event frequency and probable loss magnitude.
• Select an appropriate methodology for a given organizational context.
• Evaluate the strengths and limitations of each framework.
• Design a risk assessment plan integrating multiple methodologies.

Overview

In Tutorial 6.3, we introduced the fundamentals of risk management: assets, threats, vulnerabilities, risk calculation, and treatment. In this tutorial, we move from concepts to methodologies. A risk assessment methodology provides a structured, repeatable process for identifying, analyzing, and evaluating risks. Different methodologies emphasize different aspects—some are asset-centric, others threat-centric; some are qualitative, others quantitative; some are tailored to specific industries, others are generic.

We will examine four of the most widely used risk assessment frameworks: NIST SP 800-30 (the US government standard), ISO/IEC 27005 (the international standard aligned with ISO 27001), OCTAVE (an asset-based methodology developed by Carnegie Mellon), and FAIR (a quantitative framework focused on financial risk). We will also touch on other approaches such as COBIT's risk management and the CIS RAM.

By the end of this tutorial, you will be able to select and apply the most appropriate methodology for a given scenario, recognizing that no single framework fits all contexts. You will also understand how to combine elements from multiple frameworks to create a tailored approach. This knowledge is essential for security practitioners who need to conduct robust risk assessments that inform governance and business decisions.

NIST SP 800-30: Guide for Conducting Risk Assessments

Overview and Purpose

NIST Special Publication 800-30 (Revision 1, 2012) is a foundational document for risk assessment in US federal agencies and is widely adopted in the private sector. It provides a comprehensive, step-by-step methodology for conducting risk assessments of information systems and organizations. The framework emphasizes a threat-oriented approach, focusing on identifying threat sources and the vulnerabilities they exploit.

The Four-Step Process

NIST SP 800-30 divides the risk assessment process into four primary steps:

1. Prepare for the Assessment: Define the scope, identify the purpose, and gather necessary resources. This includes setting the assessment boundaries, identifying stakeholders, and selecting the risk assessment methodology (which may be tailored from NIST's guidance).
2. Conduct the Assessment: This is the core analysis phase, which itself has several sub-steps:
   • Identify threat sources: List potential adversaries, natural events, human errors, etc.
   • Identify vulnerabilities: Determine weaknesses that could be exploited by the threat sources.
   • Determine likelihood: Estimate the probability of a threat exploiting a vulnerability.
   • Determine impact: Assess the adverse effects on organizational operations, assets, or individuals.
   • Determine risk: Combine likelihood and impact to assign a risk level (typically using a risk matrix).
3. Communicate the Results: Share the risk assessment findings with stakeholders in a clear, actionable format. This may include risk registers, risk reports, and presentations.
4. Maintain the Assessment: Risk assessments are not one-off activities. They must be updated regularly to reflect new threats, vulnerabilities, and changes in the environment. This step emphasizes the continuous nature of risk assessment.

Detailed Sub-Steps of "Conduct the Assessment"

The "Conduct" phase is the most intricate and is further broken down into a series of activities that can be represented as a workflow:

        ┌─────────────────────────────────────────────────────────────────────┐
        │            NIST SP 800-30 Risk Assessment Process                  │
        ├─────────────────────────────────────────────────────────────────────┤
        │                                                                     │
        │  1. Identify threat sources (adversaries, natural, human, etc.)    │
        │               │                                                     │
        │               ▼                                                     │
        │  2. Identify vulnerabilities (weaknesses in systems/processes)     │
        │               │                                                     │
        │               ▼                                                     │
        │  3. Determine likelihood (probability of threat exploiting vuln)   │
        │               │                                                     │
        │               ▼                                                     │
        │  4. Determine impact (consequences of successful exploitation)     │
        │               │                                                     │
        │               ▼                                                     │
        │  5. Determine risk (combine likelihood and impact)                 │
        │               │                                                     │
        │               ▼                                                     │
        │  6. Prioritize risks (high, medium, low)                          │
        │                                                                     │
        └─────────────────────────────────────────────────────────────────────┘
        

Likelihood and Impact Scales: NIST recommends using qualitative scales (e.g., Very High, High, Moderate, Low, Very Low) for both likelihood and impact, which are then combined in a risk matrix to produce an overall risk level. The framework also allows for quantitative approaches when data is available.

Worked Example: NIST SP 800-30 in Action

Scenario: A small financial services firm is assessing the risk of a data breach due to a phishing attack.

• Threat source: External attackers using phishing emails to obtain employee credentials.
• Vulnerability: Employees lack awareness of phishing techniques, and email filters are not sufficient to block all malicious emails.
• Likelihood: Based on industry statistics and the firm's history, the likelihood is rated as High (several successful phishing attempts have occurred in the past year).
• Impact: If credentials are stolen, attackers could access customer data, leading to regulatory fines, reputational damage, and loss of business. Impact is rated as Very High.
• Risk Level: Combining High likelihood and Very High impact yields a risk level of Critical (top of the risk matrix).

The firm then proceeds to treatment (e.g., implementing MFA, enhancing email filtering, and conducting phishing training).

ISO/IEC 27005: Information Security Risk Management

Overview and Purpose

ISO/IEC 27005:2018 is the international standard that provides guidelines for information security risk management. It is closely aligned with ISO/IEC 27001, the standard for Information Security Management Systems (ISMS). While ISO 27001 specifies requirements for an ISMS, ISO 27005 offers a structured approach to risk assessment and treatment that supports compliance with the ISMS requirements.

The standard is generic and can be applied to any organization, regardless of size or sector. It emphasizes a risk-based approach and provides a detailed process for establishing the context, assessing risks, and treating them.

The ISO 27005 Risk Management Process

The process consists of several key activities, often represented in a cycle:

1. Context Establishment: Define the scope, the organization's risk management framework, and the risk criteria (risk appetite, tolerance).
2. Risk Assessment: This includes three sub-steps:
   • Risk Identification: Identify assets, threats, vulnerabilities, and existing controls. Produce a list of risks.
   • Risk Analysis: Assess the likelihood and impact of each risk, using qualitative or quantitative methods. Assign a risk value.
   • Risk Evaluation: Compare the risk values against the risk criteria to prioritize risks and determine which need treatment.
3. Risk Treatment: Select and implement controls (using the options of accept, avoid, mitigate, transfer). This is often linked to Annex A of ISO 27001 which provides a catalog of controls.
4. Risk Acceptance: Formally accept residual risks that fall within tolerance.
5. Risk Communication and Consultation: Engage stakeholders throughout the process.
6. Risk Monitoring and Review: Continuously track risks and effectiveness of controls.

ISO 27005 is asset-centric in that it starts with assets and their values, but it also incorporates threat and vulnerability identification. It is methodologically flexible, allowing for both qualitative and quantitative approaches.

Comparison with NIST SP 800-30

Aspect	NIST SP 800-30	ISO 27005
Primary Audience	US federal agencies, critical infrastructure	Any organization, especially those seeking ISO 27001 certification
Approach	Threat-centric	Asset-centric, but integrated
Steps	Prepare, Conduct, Communicate, Maintain	Context establishment, Risk assessment (identification, analysis, evaluation), Treatment, Acceptance, Communication, Monitoring
Flexibility	Moderate, with detailed guidance	High, with options for qualitative/quantitative
Integration	Part of NIST Risk Management Framework (RMF)	Part of ISO 27001 ISMS

Both frameworks are compatible and can be used together; many organizations use NIST SP 800-30 for detailed technical assessments and ISO 27005 for the overarching ISMS risk management.

OCTAVE: Operationally Critical Threat, Asset, and Vulnerability Evaluation

Overview and Purpose

OCTAVE (Operationally Critical Threat, Asset, and Vulnerability Evaluation) is a methodology developed by Carnegie Mellon University's Software Engineering Institute (SEI). It is designed to be asset-centric and self-directed, meaning that organizations can conduct the assessment themselves without needing external experts.

OCTAVE emphasizes organizational risk rather than purely technical risk. It focuses on the assets that are most critical to the organization's mission and then identifies threats and vulnerabilities that could affect those assets. There are two main variants: OCTAVE Allegro (for smaller organizations) and OCTAVE Forte (for larger, more complex environments).

OCTAVE Allegro Phases

OCTAVE Allegro consists of four phases:

1. Phase 1: Asset Profile Development: Identify the organization's critical assets, their associated security requirements (CIA), and their business value.
2. Phase 2: Threat and Vulnerability Identification: For each critical asset, identify threats (using a threat catalog) and vulnerabilities that could be exploited.
3. Phase 3: Risk Analysis: Assess the likelihood and impact of each threat/vulnerability combination. OCTAVE uses a qualitative approach with defined scales.
4. Phase 4: Risk Mitigation Planning: Develop and prioritize mitigation strategies for the highest risks.

A distinctive feature of OCTAVE is the use of threat scenarios that combine threat, asset, and vulnerability to describe a specific risk event. For example: "An external attacker (threat) exploits a SQL injection vulnerability (vulnerability) in the customer database (asset) to steal credit card numbers (impact)."

Advantages and Limitations

• Advantages: Focuses on business impact; encourages participation from business stakeholders; does not require external expertise; well-suited for organizations with limited resources.
• Limitations: Primarily qualitative; may not provide the financial detail needed for cost-benefit analysis; can be time-consuming if many assets are considered.

FAIR: Factor Analysis of Information Risk

Overview and Purpose

FAIR (Factor Analysis of Information Risk) is a quantitative risk analysis model developed by Jack Jones. Unlike other frameworks that rely on qualitative scales, FAIR provides a rigorous, mathematical model for estimating risk in financial terms. It is based on the idea that risk is a function of loss event frequency and probable loss magnitude.

FAIR is particularly useful for making business cases for security investments, as it expresses risk in dollar amounts that can be compared with control costs.

The FAIR Risk Model

The FAIR model decomposes risk into two primary factors:

• Loss Event Frequency (LEF): The probable frequency of a loss event over a given time period (e.g., one year). LEF is a function of:
  • Threat Event Frequency (TEF): How often a threat event (e.g., an attack) occurs.
  • Vulnerability (V): The probability that a threat event will result in a loss event (i.e., the probability of exploitation).
• Probable Loss Magnitude (PLM): The expected financial loss if a loss event occurs. PLM is a function of:
  • Primary Loss: Direct costs (e.g., response, replacement, fines).
  • Secondary Loss: Indirect costs (e.g., reputational damage, lost business, litigation).

The overall risk (often called "Annualized Loss Expectancy" in FAIR terms) is:

However, FAIR goes deeper, incorporating uncertainty through the use of ranges and Monte Carlo simulation to produce a distribution of possible outcomes rather than a single point estimate.

FAIR Worked Example

Scenario: A company is assessing the risk of a data breach from a phishing attack.

• Threat Event Frequency (TEF): Estimated at 12 phishing attacks per year (based on logs).
• Vulnerability (V): The probability that a phishing attack leads to a compromise is estimated at 10% (0.1).
• Loss Event Frequency (LEF): 12 × 0.1 = 1.2 loss events per year.
• Probable Loss Magnitude (PLM): Estimate the average loss per breach. This includes: incident response costs ($50,000), regulatory fines ($100,000), legal fees ($30,000), lost business ($80,000), and reputational damage (estimated $50,000). Total PLM = $310,000.
• Annual Risk: 1.2 × $310,000 = $372,000.

This quantitative estimate can be used to justify investments in controls that reduce TEF or V, e.g., MFA reduces V to 2%, new LEF = 12 × 0.02 = 0.24, new risk = 0.24 × $310,000 = $74,400, a reduction of $297,600. If the control costs less than that, it is justified.

Other Methodologies (COBIT, CIS RAM, etc.)

COBIT Risk Management

COBIT (Control Objectives for Information and Related Technologies) is a framework for IT governance and management. It includes a risk management component that is integrated with its governance objectives. COBIT's risk management process aligns with ISO 31000 and emphasizes the integration of risk management into overall business governance. It provides detailed guidance on risk assessment, risk response, and risk reporting, and is often used in conjunction with other frameworks.

CIS RAM

The CIS Risk Assessment Method (RAM) is a methodology developed by the Center for Internet Security. It is designed to help organizations assess their cybersecurity risk using the CIS Controls as a baseline. CIS RAM provides a structured approach to identify, analyze, and prioritize risks, and it maps directly to the CIS Controls, making it particularly useful for organizations that have adopted the CIS Controls.

Other Notable Approaches

• OCTAVE Forte: An updated version of OCTAVE that incorporates more quantitative elements and is designed for larger organizations.
• CRAMM: The CCTA Risk Analysis and Management Method, developed by the UK government, which combines qualitative and quantitative aspects.
• MEHARI: A French methodology that focuses on risk assessment and treatment, emphasizing business continuity.

Each methodology has its strengths and is suited to different organizational contexts, risk appetites, and regulatory environments.

Comparative Analysis and Selection Criteria

Framework Comparison Matrix

Criteria	NIST SP 800-30	ISO 27005	OCTAVE	FAIR
Primary Approach	Threat-centric	Asset-centric, integrated	Asset-centric, self-directed	Quantitative, financial
Output	Risk levels (qualitative)	Risk levels (qualitative or quantitative)	Risk levels (qualitative) and scenarios	Monetary estimates, distributions
Complexity	Moderate	Moderate	Moderate (self-directed)	High (requires data and tools)
Best For	US federal, critical infrastructure	ISO 27001 compliance, general use	Small/medium enterprises, business-focused	Cost-benefit analysis, ROI justification
Integration	NIST RMF	ISO 27001 ISMS	Standalone	Often integrated with other frameworks

How to Choose a Methodology

When selecting a risk assessment methodology, consider the following factors:

• Organizational context: Is the organization in a regulated industry? Does it need to comply with specific standards (e.g., ISO 27001, NIST)?
• Risk appetite and tolerance: Does the organization require detailed quantitative analysis for investment decisions, or is qualitative prioritization sufficient?
• Available resources: Is there a dedicated risk team, or will the assessment be conducted by business stakeholders with limited expertise?
• Maturity level: A less mature organization may benefit from a simpler, self-directed methodology like OCTAVE, while a mature organization may require the rigor of FAIR.
• Integration needs: Does the methodology need to align with existing governance frameworks (e.g., COBIT, ISO 27001)?

Often, organizations use a hybrid approach, combining qualitative assessment for broad risk identification with quantitative analysis for high-priority risks.

Case Studies: Framework Application

Quiz

Exercises

Homework

Summary

In this tutorial, we have explored the major risk assessment methodologies and frameworks used in cybersecurity. We began with NIST SP 800-30, a threat-centric, step-by-step approach widely adopted in US government and critical infrastructure. We then examined ISO/IEC 27005, an asset-centric methodology aligned with ISO 27001 that offers flexibility and is suitable for organizations seeking ISMS certification.

We delved into OCTAVE, a self-directed, asset-focused methodology that emphasizes business impact and is ideal for organizations with limited resources. Finally, we explored FAIR, a quantitative framework that provides financial risk estimates and supports cost-benefit analysis and investment justification.

We compared these methodologies across multiple dimensions—approach, complexity, output, and best-fit scenarios—and discussed how to select the most appropriate framework for a given organizational context. We also highlighted the value of hybrid approaches that combine elements from multiple frameworks to meet specific needs.

Through case studies, we saw these methodologies in action across various industries and organizational sizes. The quiz, exercises, and homework provided opportunities to apply the frameworks to realistic scenarios, solidifying your understanding.

Risk assessment is a cornerstone of security governance. The methodology you choose shapes the entire risk management process. By mastering these frameworks, you are equipped to conduct effective risk assessments that inform strategic decisions, allocate resources efficiently, and ultimately protect your organization's most valuable assets.

COMP400 — Computer and Network Security (Revision 3) • Unit 6.4 • © TrustOpen University