POSTED: 10/28/1998 | FILED UNDER: coursework, risk, spreadsheets
Likelihood × Impact = Sleepless Nights
A reflection on risk assessment, and what happened when our group tried to put numbers on things that could go wrong.
I always thought security people tried to eliminate risk. This topic taught me that nobody actually does that. Risk is something you identify, measure, rank, and then make a deliberate decision about — and sometimes that decision is "we will live with it." That felt like cheating at first. By the end of our class exercise it felt like the most honest thing in the whole subject.
For the activity, our group was asked to run a small risk assessment on a made-up organization: Sunrise Print & Copy, a three-branch printing shop that keeps customer files, school thesis documents, and its billing records on a single shared office PC with an external hard drive for "backups."
1. New Insights
It starts with assets, not threats. I wanted to jump straight to listing scary attacks. Instead, the first step was boring and essential: list what the organization actually has and what it is worth. For Sunrise that meant the customer files, the billing database, the shared PC itself, the shop's Facebook page (their main source of orders), and the owner's email. You cannot protect what you have not written down.
Risk is a combination, not a feeling. We rated each risk on a 1–5 scale for likelihood and a 1–5 scale for impact, then multiplied them. Doing this forced arguments into the open. One groupmate thought ransomware was the biggest risk; once we scored it, a simple hard-drive failure with no real backup came out higher because it was both likely and devastating.
Qualitative and quantitative are both valid. Our matrix was qualitative. We also tried a quantitative calculation for one risk using Annualized Loss Expectancy: ALE = SLE × ARO. If losing the shared PC costs about ₱60,000 in hardware, recovery, and lost orders (the Single Loss Expectancy), and we expect it to happen roughly once every two years (ARO = 0.5), then the ALE is about ₱30,000 a year. Suddenly a ₱4,000 external drive plus a cloud backup subscription was very easy to justify.
There are four answers, not one. Once a risk is ranked, you can mitigate it (add a control), transfer it (insurance, or a provider who takes on the responsibility), avoid it (stop the risky activity entirely), or accept it (document it and move on). Acceptance is only legitimate when it is a conscious decision by someone with authority — not when it happens because nobody looked.
Our (Made-Up) Risk Register
| Asset | Threat / Vulnerability | L | I | Score | Treatment |
|---|
| Customer & thesis files | Hard drive failure; backup drive kept in the same room and rarely updated | 4 | 5 | 20 — High | Mitigate: automated daily cloud backup, monthly restore test |
| Shared office PC | Ransomware via email attachments; staff share one admin account | 3 | 5 | 15 — High | Mitigate: separate standard user accounts, endpoint protection, patching schedule |
| Shop Facebook page | Account takeover; owner's password reused, no 2FA | 3 | 4 | 12 — Medium | Mitigate: unique password + 2FA, add a second admin |
| Billing records | Data entry errors by staff | 3 | 2 | 6 — Low | Accept: monthly reconciliation by owner |
| Branch equipment | Flooding during typhoon season | 2 | 4 | 8 — Medium | Transfer: business insurance; raise equipment off the floor |
| Customer USB drives | Malware from customer flash drives plugged into the print PC | 4 | 3 | 12 — Medium | Mitigate: isolated print workstation, auto-scan on insert |
L = likelihood, I = impact (1–5 each). Score = L × I. 1–7 Low, 8–14 Medium, 15–25 High.
⚠ THE ONE THAT STUCK WITH ME:
Residual risk never hits zero. After we applied every control in our register, every risk was still there — just smaller. The goal of risk assessment is not a perfectly safe organization; it is an organization that knows exactly how much risk it is carrying and chose to carry it.
2. Concepts I Want to Read More On
- Formal frameworks. We used a simple matrix. I want to see how NIST SP 800-30 and ISO/IEC 27005 structure a real assessment and how much of it is documentation versus analysis.
- Where ARO numbers come from. We basically guessed our Annualized Rate of Occurrence. I want to learn how professionals estimate it using incident data, industry reports, or insurance statistics.
- FAIR (Factor Analysis of Information Risk). I read that it tries to make quantitative risk analysis more rigorous with ranges instead of single numbers. That sounds like a fix for our guessing problem.
- Risk appetite. Who decides how much risk is "acceptable," and how is that written down so that people below the owner can make consistent decisions?
3. Confusions and Challenges
Our numbers felt made up — because they were. Giving a likelihood of "3" versus "4" was often a coin flip, and two groupmates could score the same risk very differently. I understand now that the matrix is useful for ranking and for starting conversations, but I struggled with how much to trust a score built on opinions.
Multiplying ordinal numbers. A 2 × 5 and a 5 × 2 both give 10, but a rare catastrophe and a frequent nuisance are very different problems. Our matrix treated them the same, and I am not sure how real organizations correct for that.
Threat versus vulnerability, again. When filling in the register, we kept writing threats in the vulnerability column and vice versa. "No 2FA" is a vulnerability; "account takeover" is the threat event. Writing them precisely was harder than it sounds.
Deciding when to accept. Accepting a risk felt like giving up. It took a while to see that, for a small shop, spending ₱50,000 to prevent a ₱3,000 problem is its own kind of failure.
Where I landed: risk assessment is less about predicting the future and more about having a defensible reason for where the money and effort go. Even with our guessed numbers, the exercise turned "everything is scary" into a ranked list we could actually act on — and that is a big upgrade.
Comments (3) | Trackback | E-mail this page to a friend