Cybersecurity — Risk

Risk equation

Risk = Threat × Vulnerability × Impact

Risk assessment process

1. Identify assets
2. Identify threats
3. Assess vulnerabilities
4. Calculate risk
5. Implement controls
6. Monitor and review

Risk calculation

def calculate_risk(threat, vulnerability, impact):
    """Calculate risk score (1-10)"""
    return threat * vulnerability * impact

# Example
risk = calculate_risk(threat=5, vulnerability=3, impact=4)
print(f"Risk Score: {risk}")  # 60

Risk matrix

risk_matrix = {
    'low': (1, 4),
    'medium': (5, 12),
    'high': (13, 24),
    'critical': (25, 100)
}

def get_risk_level(score):
    for level, (min_val, max_val) in risk_matrix.items():
        if min_val <= score <= max_val:
            return level
    return 'unknown'

Treatment options

1. Mitigate: Implement controls
2. Transfer: Insurance
3. Avoid: Stop activity
4. Accept: Acknowledge risk

Best practices

1. Regular assessments
2. Document decisions
3. Monitor controls
4. Update risk register

Mini Practice

1. Identify assets
2. Assess threats
3. Calculate risk scores
4. Document treatment

Up Next

Continue with Business Continuity - Resilience.