Tutorial 4: Risk Analysis and Treatment

Unit 1 ยท Security foundations and risk

Objectives

Risk analysis turns a threat model into decisions. A qualitative matrix can multiply likelihood and impact categories, but the result is not mathematical truth. Record evidence, uncertainty, dependencies, and time horizon. A risk owner accepts responsibility for treatment and residual risk; security staff advise and verify rather than silently owning every business decision.

Inherent risk: likelihood 4 x impact 5 = high
Treatment: MFA + anomaly detection + recovery test
Residual risk: likelihood 2 x impact 5 = medium

Avoidance removes the risky activity. Mitigation reduces likelihood or impact. Transfer moves some financial consequence, but not accountability. Acceptance is a conscious decision within risk appetite, with an expiry or review date. Reassess when systems, threats, regulations, or business impact change.

Exercises

  1. Build a 3x3 likelihood-impact matrix and define each category.
  2. Choose treatments for a legacy server, an exposed API, and a low-value public site.
  3. Write a risk register entry with owner, due date, and review trigger.

Self-check

  1. What is residual risk?
  2. Does insurance remove technical risk?
  3. Who should own a business risk?

Self-Check Quiz

1. What does mitigation do?

AnswerIt reduces the likelihood or impact of a risk through controls or design changes.

2. Is risk acceptance the same as ignoring risk?

AnswerNo. Acceptance should be informed, authorized, documented, and reviewed.

Homework

  1. Create a risk register for a payroll web system.
  2. Recommend treatments for the three highest risks.
  3. Explain how you would measure whether treatment worked.
Sample answer

Useful measures include MFA coverage, time to revoke access, critical vulnerability age, tested restore time, unauthorized access attempts, and control-test results. A register should name an accountable owner and review date; a treatment is incomplete until evidence shows the risk changed.