Tools and Techniques for Risk Evaluation

• Risk Matrix: A visual tool that plots risks on a grid based on their likelihood and impact.
• SWOT Analysis: Identifies strengths, weaknesses, opportunities, and threats related to risks.
• Monte Carlo Simulation: A quantitative technique that uses probability distributions to model and analyze the impact of risks.
• Failure Mode and Effects Analysis (FMEA): Identifies potential failure modes within a system and their impact.

Risk Formula

• Risk = Threat x Vulnerability x Impact
• Likelihood = Threat x Vulnerability
• Risk = Likelihood x Impact
• Impact - Measures the consequence of a successful attack.

Risk Matrix

• Catastrophic: ctr
• Critical: cr

  Impact\Likelihood	Very Low	Low	Medium	High	Very High
  Very Low	Trivial	Minor	Minor	Major	cr
  Low	Minor	Minor	Major	Major	cr
  Medium	Minor	Major	Major	cr	ctr
  High	Major	Major	cr	ctr	ctr
  Very High	Major	cr	ctr	ctr	ctr

Threat Model Frameworks

• STRIDE
• DREAD
• PASTA
• VAST
• NIST

STRIDE

• Spoofing - Spoofing occurs when someone masquerades as a person or system they are not.
• Tampering - Someone alters data
• Repudiation - The ability to deny something
• Information Disclosure - Threat of leaking privileged or sensitive information
• Denial of Service - Aims to render a service or system unusable
• Elevation of Privilege - A user performs actions not intended for their level of permissions

Context

• Threat Models: The process for identifying potential security threats and vulnerabilities, evaluating the risk, determining mitigations for such threats, and prioritizing any mitigations or fixes to the system.

• Vulnerability: It is a weakness in a system or software that can be exploited to make a system behave in an unintended way.

• Threat: A threat is a hypothetical event wherein an attacker could use (or exploit) a vulnerability.

• Asset Valuation: asset - An asset in the context of information security is anything of value to a business that is related to information systems.

• Mitigation and Prioritizing Risk: mitigation is an action taken to reduce the risk of a given threat.