-: Qualitative and quantitative assessments.
In the last lesson, I mentioned qualitative twice.
Once for likelihood,
and once for severity.
Both of those are qualitative assessments.
We're going to talk about what those are here
because qualitative measurements are subjective.
It's a gut feeling.
It's kind of squishy,
and I think it's bad.
I think it's good, I think it's okay.
That kind of a measurement.
Now, we talk about quantitative, it's numbers based.
It's factual.
Managers love facts, and they love numbers.
It's great if you could say,
"This risk will calculate to an annual loss of
1.2 million dollars
because then they go, "Oh, we need to stop and fix that."
Right?
This risk is gonna cost us 1.2 dollars.
"Well, we don't care about that,
it's only $1.20, right?
Those are the things you gotta think about
when you talk about numbers.
Qualitative measurements all subjective
and it's kinda gooey.
Now, if you're taking the CSA+ exam,
you don't need to understand quantitative
numbers based assessments,
because they're kind of complex.
But if you start taking CASP or CISSP,
those quantitative assessments are going to be there.
Because those are manager certifications
and they are required to know that.
As an analyst,
we're not required to know that.
We just feed into those sometimes with the metrics we use.
Let's talk about a qualitative example here.
Let's say I have this chart.
You can see here,
I have likelihood up one axis,
and I have impact on the other axis.
Low, medium, and high.
Some place in here is where this example is gonna be.
Let's take our example of
we talked about a hurricane hitting Kansas, right?
Kansas again, in the middle of the United States,
very unlikely that a hurricane is gonna happen.
So likelihood very low.
Impact if a hurricane hits Kansas,
also fairly low.
Why?
Because if it does hit there,
it's kind of in the middle of the U.S.
By the time the hurricane gets there,
it's only gonna be a lot of rain and a lot of wind,
but they'll survive, right?
They're kind of used to that.
It's not a big deal.
So that's one example.
Now, let's take another example.
Let's say I have something that's a
low likelihood of happening, but very high impact.
Let's say, an earthquake, right?
Or even better, a data breach, right?
You are a company that stores
medical record information on patients, right?
The likelihood that you are going to get attacked is low.
Most nation states and hackers
are not looking for your small doctor's office to hack.
So low likelihood,
but if they do attack you,
it has a very high impact
because they're gonna steal all your customer's data.
You're customers aren't gonna trust you,
and it's gonna cost you a lot of money to clean it up.
So, overall your impact is medium, right?
High impact, low likelihood is gonna give you
overall risk of a medium risk.
That's the idea here in the second example.
Now, some ways that you can do this numerically,
this quantitative stuff,
is something called an annual loss expectancy,
as shown here on your screen.
There's a common calculation to determine the cost
associated with a particular risk.
This is gonna help us in determining when to
accept, avoid, transfer, or mitigate a risk.
Based on the cost associated with it.
When you talk about ALE or Annual Loss Expectancy,
it's a really simple calculation.
It's cost times the occurrences,
and how many times it happened annually, right?
Let's say that something happens three times per year,
then the occurrence would equal 3.0.
If instead, the risk is actualized once every three years,
it's gonna be .33 or 1/3.
So I would say, "Every time this happens,
it costs me a million dollars."
That's cost.
It happens three times a year, three.
That means three times one is three million dollars.
That's an annual loss expectancy of three million dollars.
We want to spend some money on fixing that problem, right?
That's the idea here with annual loss expectancy.
Now, if we look at this example here,
we have one million dollars times five times a year,
it's a five million dollar problem.
This risk is large, and it's gonna happen five times a year.
We want to spend five million dollars to mitigate this risk.
If it costs me 10 million dollars to fix this risk,
would I fix it?
Well, no.
Because it would cost me 10 million dollars a year
to fix it,
but only five million dollars to pay for it.
I would just pay the five million dollars a year, right?
Now conversely, if it costs me a $100,000
to prevent this,
and it's gonna cost me five million dollars a year
if this bad thing happens.
Well, certainly I would give you $100,000
to stop this problem.
That's the whole idea here with annual loss expectancy.
It's a really easy way for managers to think
in dollars and cents on what happens,
and whether they should accept the risk
or pay to fix the risk.
Here's another example.
Let's say I had something that happens
once every five years.
Every time it happens, it costs me a million dollars
if we have a data breach.
But it only happens to me once every five years.
Well, then I'd only want to spend up to
$200,000 to mitigate it
because that's my annual loss expectancy.
So if it costs me a million dollars to fix it,
forget it, I'll just keep paying $200,000 each time, right?
That's the idea here with annual loss expectancy.
Really straight forward concept,
and I know you guys will get this.
That's an example of a quantitative assessment.
Ones we showed earlier,
with likelihood and severity,
that's a qualitative assessment.
Remember, qualitative is subjective.
Quantitative is numbers based.