Instructor: In this lesson, 2 2
we're going to talk about risk calculations. 3 3
Now, there are two very popular ways 4 4
of performing risk calculations. 5 5
These are known as quantitative and qualitative 6 6
risk calculations. 7 7
Let's start out with quantitative risk calculations. 8 8
Now, a quantitative risk calculation is a method 9 9
of risk assessment that uses mathematical 10 10
and statistical techniques to assign numerical values 11 11
to the likelihood and impact of potential threats. 12 12
This involves calculating the probability 13 13
of a specific threat that's going to occur 14 14
as well as the magnitude of the impact 15 15
if that threat was to materialize. 16 16
Our result of this calculation is going to be 17 17
a numerical representation of the risk associated 18 18
with a particular threat. 19 19
Now, quantitative risk calculation is really 20 20
just a simple formula. 21 21
Risk equals probability times impact. 22 22
Now, the probability 23 23
of a threat occurring is usually going to be expressed 24 24
as a percentage, for example, 50% or 90% 25 25
or you could write this as a decimal 26 26
like 0.5 for 50% or 0.9 for 90%. 27 27
Let's take the example of 50%. 28 28
Now, if you have a probability of 50% 29 29
this means the likelihood 30 30
of that threat occurring is just as likely to happen 31 31
as it is not to happen. 32 32
Basically, it's just a coin toss. 33 33
Now, on the other hand, if your probability is 90% 34 34
this means that the likelihood 35 35
of that thing happening is nine times as likely 36 36
as that thing not happening. 37 37
So if we see a higher probability, like 90% 38 38
it is something we probably need to protect ourselves 39 39
against because it's very likely 40 40
that that threat is going to materialize. 41 41
Now, the second part of our formula involves the impact. 42 42
The impact is typically measured 43 43
in terms of the financial loss 44 44
or damage that would result if the threat was materialized. 45 45
Basically, how bad or how severe is this threat going to be 46 46
if it actually happens? 47 47
Now in the physical world, let's say I have 48 48
a small bomb that's going to detonate in my backyard 49 49
like a firecracker, that would have a very low impact, 50 50
but if I exploded a large bomb, it might take 51 51
down my entire house or maybe even my neighbor's houses too. 52 52
So it would have a really large impact. 53 53
In the cyber world, we might look at two threats 54 54
such as one where somebody's able to access 55 55
one of our testing servers and download a video 56 56
from a file containing a lesson 57 57
from a retired certification exam, like the first version 58 58
of the CySA+ exam. 59 59
If that happened, it would be a pretty low impact 60 60
to us because that exam is no longer offered 61 61
and that video is really old and out of date 62 62
and we've refiled it several times since then. 63 63
On the other hand, if we had somebody who was able to hack 64 64
into our production servers and download our entire database 65 65
of student names and emails 66 66
that would have a much larger impact for our company 67 67
and so it would have a higher value 68 68
for this impact equation in terms of the potential risk. 69 69
Now, if we go back to our formula for risk, we said 70 70
that risk equals probability times impact, and so we can see 71 71
that we can multiply these two values together 72 72
to calculate the overall risk 73 73
using this mathematical formula. 74 74
Now, this type of quantitative risk calculation 75 75
is really useful for an organization 76 76
because it allows us to better prioritize our risk 77 77
management efforts by identifying which risks 78 78
are considered the most likely to happen 79 79
and have the greatest potential impact 80 80
against our organization. 81 81
Additionally, it provides a clear and objective way 82 82
for us to communicate risk up to our stakeholders 83 83
and to make data-driven decisions about risk management. 84 84
Now, some other quantitative risk calculations 85 85
we're going to use are things like our single loss expectancy 86 86
and annual loss expectancy for a given asset 87 87
such as a server, a system, 88 88
or the entire enterprise network. 89 89
Now, a single loss expectancy, which is written as SLE 90 90
is a metric that's used in quantitative risk 91 91
calculations to determine the expected financial loss 92 92
from a single event. 93 93
It's going to be calculated 94 94
by multiplying the asset value by the exposure factor 95 95
and then we represent all of this using the formula. 96 96
SLE equals AV for asset value times EF for exposure factor. 97 97
Now, the asset value or AV is going to be the monetary value 98 98
of the asset that is at risk 99 99
and the exposure factor or EF is a percentage 100 100
of loss that would result from a specific threat. 101 101
Now, let's say for example 102 102
an organization has an asset valued 103 103
at a hundred thousand dollars 104 104
and the exposure factor for a particular threat is 10% 105 105
then our SLE would be $10,000 because $100,000 106 106
times 10% or 0.10 is going to equal 10,000. 107 107
This means that if the threat actually occurs 108 108
the organization can expect to lose $10,000. 109 109
Now, people often ask me 110 110
how do we calculate the exposure factor 111 111
for this SLE equation? 112 112
Well, the exposure factor or EF is really the amount 113 113
of the assets value that'll be lost for a specific threat. 114 114
So let me give you a couple 115 115
of examples of this to help solidify this concept. 116 116
Let's pretend 117 117
that I just built a new web application that runs 118 118
across a clustered server with 10 servers. 119 119
If I was calculating the exposure factor 120 120
for that server cluster 121 121
and two of the 10 servers were unusable 122 122
because of a ransomware attack 123 123
then I now have eight out of 10 servers that remain usable 124 124
and this gives me an exposure factor 125 125
of 20% because two unusable servers divided 126 126
by 10 total servers is 20% or 0.2 for my exposure factor. 127 127
Or let's pretend I have an office building 128 128
and I have 20 offices inside of it, 129 129
but we had a pipe burst and it flooded one 130 130
of those offices, and now that's unusable. 131 131
This means I now have 19 132 132
of the 20 offices that are still available 133 133
for people to use. 134 134
So I have one unusable office divided by 20 total offices 135 135
and this gives me 5% or 0.05 as my exposure factor. 136 136
Now, this single loss expectancy is a really important 137 137
metric for us to consider 138 138
because it allows our organizations 139 139
to determine the expected loss from a single event 140 140
and then prioritize our risk management efforts. 141 141
This single loss expectancy can also be used 142 142
to help establish the cost benefit 143 143
of different risk management strategies 144 144
and it can help us to develop a budget 145 145
for risk management overall inside of our organization. 146 146
Now, the single loss expectancy is really useful 147 147
in understanding the expected cost of a single event 148 148
or threat that's being realized, but it doesn't account 149 149
for the likelihood of multiple events occurring. 150 150
To understand the annual cost of a given threat though 151 151
we need to instead calculate the annual rate 152 152
of occurrence known as the ARO 153 153
and the annualized lost expectancy known as the ALE. 154 154
Now, the annual rate of occurrence 155 155
or ARO is the number of times 156 156
per year that a specific threat is expected to occur. 157 157
The easiest way to calculate this number 158 158
is to simply count the number of times 159 159
that that thing happened in a given year. 160 160
For example, if I'm calculating the ARO for data breaches 161 161
I might look at the organization's history 162 162
and see that they had three breaches in the last 12 months. 163 163
So their ARO or annual rate of occurrence is three, 164 164
because they had three breaches in one year. 165 165
But what if something happens less frequently? 166 166
Well, then you're going to have to get a number less than one 167 167
and you really can't simply count them 168 168
up during a single year. 169 169
So instead, we need to calculate the ARO 170 170
by counting the number of occurrences of a threat 171 171
in a given period of time and then dividing it 172 172
by the total number of years in that period. 173 173
So our basic formula for the annual rate of occurrence 174 174
is the number of times the threat occurred divided 175 175
by the number of years in the period that we counted. 176 176
For example, if a threat occurs one time every three years 177 177
the annual rate of occurrence would be one divided by three 178 178
or one third, which equals 0.33 occurrences per year. 179 179
Now that we have our SLE and our ARO 180 180
we can now calculate the annual loss expectancy 181 181
or the ALE. 182 182
Now, the annual loss expectancy is the expected 183 183
financial loss from multiple events during a year. 184 184
The annual loss expectancy is calculated 185 185
by multiplying the single loss expectancy 186 186
by the annual rate of occurrence, and the formula 187 187
for this is ALE equals SLE times ARO. 188 188
For example, 189 189
if an organization has a single loss expectancy of $10,000 190 190
an annual rate of occurrence of 0.33 occurrences per year 191 191
the annual loss expectancy is going to be $3,333.33 192 192
because I have $10,000 times one third 193 193
or 0.33 occurrences per year 194 194
and this gives me $3,333.33. 195 195
Which is what the organization can expect to lose each year 196 196
due to that specific threat. 197 197
Now as I'm doing my risk management 198 198
and trying to mitigate that risk, I'm going to look 199 199
at this and then decide is it worth protecting 200 200
against this particular risk? 201 201
For example, let's say you called me up and said, Jason 202 202
I'm a cybersecurity analyst, and I can mitigate that risk 203 203
for you 100% and it'll only cost you $25,000 per year. 204 204
I would say no thank you because I don't want to spend $25,000 205 205
per year to solve a risk that is only costing me 206 206
$3,333.33 per year. 207 207
In fact, I can have this risk occur seven times more often 208 208
and it would still be cheaper 209 209
for me to simply allow that event to occur 210 210
than to pay you to protect me against it. 211 211
Now, on the other hand, if you had a security 212 212
as a service solution that would only cost me 213 213
a hundred dollars per month, I would probably buy it 214 214
because a hundred dollars a month is only $1,200 per year 215 215
and that's almost one third the cost 216 216
of the annual loss expectancy that I calculated 217 217
for this given threat of $3,333.33 218 218
so it would make good business sense for me to mitigate this 219 219
and solve the underlying risk by paying you $1,200 per year. 220 220
You see how easy it is to make decisions when 221 221
you have a quantitative risk calculation 222 222
for the annual loss expectancy, and this is why 223 223
most executives really love using quantitative 224 224
risk analysis when they're making their business decisions. 225 225
By having your metrics for SLE, ARO and ALE in hand 226 226
you can have a more comprehensive view 227 227
of the risk you're going to be taking into account as well 228 228
as the likelihood of multiple events occurring 229 229
over a given period of time, and then compare all that 230 230
against the cost to remediate those risks. 231 231
Sometimes though, you simply can't put a number 232 232
on the risk you're looking at 233 233
because you don't know all the costs 234 234
or the potential liability behind a particular threat 235 235
and when this happens, you're going to have to 236 236
utilize a qualitative risk calculation instead. 237 237
Now, a qualitative risk calculation is a method 238 238
of risk assessment that uses subjective judgment 239 239
and expert opinions to evaluate the likelihood 240 240
and impact of potential threats. 241 241
It doesn't rely on mathematics 242 242
or statistical techniques to assign numerical values 243 243
to the likelihood and impact of the threats 244 244
like we did with a quantitative risk calculation. 245 245
Instead, we're going to use a more flexible 246 246
and subjective approach to assess our risk. 247 247
In a qualitative risk calculation, 248 248
experts in the field such as a cybersecurity analyst 249 249
or cybersecurity engineer are going to use their knowledge 250 250
and experience to evaluate the likelihood 251 251
and impact of potential threats. 252 252
They may then use a variety 253 253
of methods to gather information about the risks 254 254
such as brainstorming, interviews or focus group sessions. 255 255
Now, once that information is gathered 256 256
the experts will then use their judgment 257 257
and expertise to assign a qualitative rating to that risk. 258 258
This rating can be based on factors such as the likelihood 259 259
and impact and can be described using terms 260 260
such as high, medium, and low. 261 261
Qualitative risk calculations are really useful 262 262
because it allows organizations to evaluate risk 263 263
even when there is limited data available. 264 264
It can also provide valuable insight into new 265 265
and emerging risks that may not have been seen before. 266 266
Additionally, it can be useful 267 267
for organizations with limited resources too 268 268
because it generally requires less time and effort 269 269
than doing a full mathematical based quantitative 270 270
risk calculations. 271 271
Now, most of the time 272 272
if you're using a qualitative risk analysis 273 273
you'll generate a simple three by three 274 274
or four by four chart, 275 275
and along one axis you'll plot the likelihood 276 276
and along the other you'll plot the impact. 277 277
Usually, if you're using a three by three matrix 278 278
you'll use low, medium, and high. 279 279
But if you're using a four by four matrix 280 280
you'll use low, medium, high, and critical 281 281
and your organization can use whatever terms they want 282 282
but those are the most common ones that we see in the field. 283 283
Now, let's say for example 284 284
I had something that's a low impact 285 285
and a low probability, 286 286
overall we're going to rate this as a low and mark it is green. 287 287
Now, if I have something with a high impact 288 288
and a low probability, I would rate this overall 289 289
as a medium risk and then mark it yellow. 290 290
Now, if I have something that has a high impact 291 291
and a high probability, I'm going to rate this 292 292
as an overall high risk and mark it red. 293 293
For this reason, a lot of people call these stoplight charts 294 294
because the overall result we're looking it 295 295
is either green, yellow, or red for each identified risk. 296 296
Now, there are several reasons why qualitative 297 297
risk calculations are sometimes preferred 298 298
over quantitative risk calculations 299 299
inside the cybersecurity industry. 300 300
This includes reasons like complexity, unknowns, 301 301
limited data, resource constraints, and communication. 302 302
First, we have complexity. 303 303
Cybersecurity threats are often highly complex 304 304
and may be difficult to quantify using mathematical 305 305
and statistical techniques. 306 306
Because of this, qualitative risk calculations do allow 307 307
for a more subjective 308 308
and flexible approach to evaluating these types of risks. 309 309
Now, second, we have unknowns. 310 310
In cybersecurity there are a lot of threats 311 311
that are constantly evolving and there's new threats 312 312
in zero-days that are emerging all the time. 313 313
Quantitative risk calculation relies on historical data 314 314
which may not be available 315 315
for these new and emerging threats. 316 316
Therefore, qualitative risk calculations will allow 317 317
for the inclusion of expert opinions 318 318
and subjective judgment, which can provide valuable insight 319 319
into the likelihood and impact of these new threats. 320 320
Number three, we have limited data. 321 321
In some cases, there may be limited data available 322 322
to support a quantitative risk calculation. 323 323
For example, there's a new threat that has never 324 324
been seen before and there's no historical data 325 325
for us to use for the analysis. 326 326
Because of this, 327 327
we can still use a qualitative risk calculation 328 328
by using our experts and our knowledge 329 329
and judgment instead of relying on that historical data. 330 330
Fourth, resource constraints. 331 331
Quantitative risk calculations can be really time consuming 332 332
and resource intensive. 333 333
Now, it's really easy with the formulas, 334 334
but you have to get what is that exposure factor? 335 335
What is that asset value? 336 336
How many times did this thing happen 337 337
over the last year or five years or 10 years? 338 338
And all of that can take a lot of time. 339 339
So by doing a qualitative risk calculation instead 340 340
we can generally have a less complex method 341 341
and it can be performed more quickly 342 342
and it makes it very well suited 343 343
for organizations with limited resources. 344 344
And the fifth reason is communication. 345 345
Qualitative risk calculations often use natural 346 346
language instead of monetary values in math. 347 347
This makes it a lot easier to understand for non-experts 348 348
and this can help communicate the risk 349 349
over to senior decision makers if they're not 350 350
very technically minded or financially minded. 351 351
Now, it is worth noting 352 352
that qualitative risk calculations may not be as accurate 353 353
as a quantitative risk calculation, and it's not 354 354
recommended to solely rely on qualitative risk calculations. 355 355
Most often I see a hybrid approach being used 356 356
where both qualitative and quantitative risk calculations 357 357
are being used together to provide a more comprehensive view 358 358
of all the risks facing an organization. 359 359
This semi quantitative method 360 360
or what I like to call a hybrid risk analysis 361 361
is really going to use a mixture 362 362
of concrete values with the opinions 363 363
and reasoning to measure the likelihood and impact of risk. 364 364
Now, this method is used a lot to try 365 365
to measure things that you can't measure necessarily 366 366
very easily when you're dealing with dollars and cents. 367 367
And so you can't do a full quantitative method, 368 368
but you may have some data that you can use 369 369
that can give you at least a baseline or a feeling 370 370
about the dollars and cents that you're talking about. 371 371
Let me give you a couple of examples. 372 372
Let's say, for example, you want to calculate 373 373
how much employee morale is worth 374 374
in your company in dollars. 375 375
Now, honestly, that's a really hard thing to answer 376 376
because there really is no definitive way to quantify 377 377
in dollars employee morale. 378 378
But you may be able to start thinking 379 379
of some things like linking employee morale 380 380
to your productivity and saying, 381 381
well if the morale is high, I see that people work harder 382 382
and they work longer, and that makes our company more money. 383 383
Or if they have low morale, they're working less 384 384
and they don't do as much work for us 385 385
and it costs us more money to get the same 386 386
work, product out to our customers. 387 387
And so you might be able to start putting a couple 388 388
of dollars and cents numbers to it 389 389
but it's not going to be really easy. 390 390
It's not like I can definitively say, 391 391
well if I have just one more point of employee morale 392 392
that's going to save me a thousand dollars in labor costs. 393 393
So employee morale in dollars 394 394
and cents is not going to be really easy for us to calculate 395 395
and instead we're going to have to use more 396 396
of this hybrid or semi quantitative method to calculate it. 397 397
Now, another good example might be 398 398
your company's reputation. 399 399
How much is your company's reputation worth in dollars? 400 400
Again, this is a hard one 401 401
because it takes years to build a reputation 402 402
and only moments to destroy it. 403 403
I'm sure if I pressed you really hard 404 404
you could assign a dollar figure to it, 405 405
but there'd be some kind of squishiness to it 406 406
because it's really a best guess and not an exact science. 407 407
You might look at some historical values 408 408
like another company who suffered a data breach 409 409
and how their stock prices reacted to it 410 410
or if their sales went down afterwards or other factors 411 411
and that way you can get an idea 412 412
of how much their reputation was worth. 413 413
But to identify exactly a number 414 414
for your own company is still going to be really hard to do 415 415
before an incident occurs. 416 416
It really is a lot easier to measure the aftermath 417 417
of a data breach because you can add up all your costs 418 418
and operational losses to calculate an exact figure 419 419
and that could represent some of this reputational harm. 420 420
Let me give you one final example to show you how 421 421
difficult this can be. 422 422
What if I asked you how much 423 423
of a cost if your network was down 424 424
between 2:00 AM and 4:00 AM on July 22nd next year? 425 425
Now, this is a really specific question 426 426
and you could probably go back and pull the historical data 427 427
from July 22nd for the last 10 years and maybe do some kind 428 428
of quantitative analysis where you can start looking 429 429
at all those numbers 430 430
and try to get something that looks right 431 431
but it's probably a lot easier 432 432
for you to look at it in a qualitative manner 433 433
and start thinking about it like this. 434 434
Hmm, my company only works from 9:00 AM to 5:00 PM each day. 435 435
So if we have a network outage between 2:00 AM 436 436
and 4:00 AM it's probably not a big deal for this company. 437 437
But if we had one between 2:00 PM and 4:00 PM 438 438
that would actually be a bigger deal for us 439 439
because that's a timeframe we're expected 440 440
to service our customers. 441 441
So I can say that between 2:00 AM and 4:00 AM 442 442
this would have a low impact 443 443
and therefore overall it might be a low event 444 444
for us or maybe possibly a medium event 445 445
if it had a really high probability of occurring. 446 446
So as you can see 447 447
there are benefits to using purely quantitative methods 448 448
'cause you get that dollars and cents answer. 449 449
And there's also benefits in using 450 450
a purely qualitative method based on reasoning 451 451
expertise and judgment. 452 452
Or you can use a hybrid of the two depending on the types 453 453
of threats you're trying to evaluate and the amount of data 454 454
or information you have at your disposal and the amount 455 455
of time you have available to make that decision. 456 456
It really isn't a this or that. 457 457
Sometimes it's this, that and the other thing. 458 458
And we can use all of these 459 459
to better understand our risk in our organizations.