-: Likelihood, impact and risk.
So we have identified the threats,
we've identified the vulnerabilities.
Now let's look at the bottom three pieces of step two,
which is determining the likelihood of the occurrence,
determining the magnitude of the impact
and determining the risk itself.
Likelihood and impact.
So this is a measurement of the risk that
the combined threat and vulnerability
are gonna pose to our organization
based on it's likelihood and impact
or the probability of it occurring.
The likelihood is just the chance
that this risk is gonna be realized,
that something bad is gonna actually happen to us.
The impact is how bad that thing really is.
It's the severity of the damage that occurs
if the risk is actually realized.
And so we have to consider our likelihood of it happening,
how often it'll happen and the impact,
how bad it is when it does happen.
Both of those things are gonna factor into
what level of risk this is,
whether it's low, medium, high or critical.
Now when we look at likelihood factors,
we have to think about what is the likelihood
that the threat will initiate the risk.
For example, there's hackers out there.
How likely is it that the hacker
is going to attack our organization?
Is it low, medium, high or critical?
What is the likelihood that if the risk occurs
we're gonna have a bad impact for us?
Well, if the organization
has proper security controls in place,
the threat may be mitigated
and there's no real adverse affect to the organization
even if the bad guy gets in.
If a guy hacks our old server over there,
it's got no data we care about.
It doesn't really matter.
If he hacks the production server
and takes us down, that costs us money.
That would be a big issue.
And so these are the likelihood factors we have to consider.
This is a qualitative analysis.
It's, where do we think it really goes?
It's a feeling. Is it low, medium or high?
You're gonna have to make that judgment call
based on your factors.
Now when we talk about impact, it is still qualitative.
It is low, medium and high
but we have to remember that there's always,
assuming that there's a threat that's gonna take place
and that the risk is realized
when you're measuring the impact.
So if you have impact, you always have to go,
let's pretend this bad thing happened.
Now how bad is it?
That's what the question you're asking.
So you have to identify the severity of the impact.
Consider each piece of the triad.
Think about confidentiality.
How does this affect it?
Integrity, how does this affect it?
Availability, how does this affect it?
Now if I combine all three, how does it affect it?
Now, how bad is it?
That's the question you need to ask
when you're considering impact.
That's the idea here.
We consider your likelihood, your impact
to figure out how bad of a risk you're really taking here.
Because at the end of the day, it's risk acceptance,
risk avoidance, risk mitigation or risk transference,
which we're gonna talk about later,
but that all comes based on our likelihood
and our impact and how severe these things are gonna be.