CY1: Security thinking: assets, threats and risk
Risk: deciding what to fix first
🎯You'll be able to
Rate risks by likelihood and impact, keep a risk register, and choose a treatment for each risk.
🏠The everyday picture
A family can't fix everything in an old house at once. A loose wire near the children's room comes before a squeaky door, even though the door annoys everyone more often.
📘What it really is
- Risk combines how likely something is and how bad it would be. A common way is to rate each from 1 to 5 and multiply them.
-
Likelihood depends on how exposed the asset is, how easy the weakness is to use, and whether it's being used in attacks already.
-
Impact covers harm to people, money, legal duties and reputation. A leak of health records has high impact by itself.
- A risk register lists each risk with its rating, owner, treatment and review date.
- Four treatments:
- Reduce: add a control (most common).
- Avoid: stop doing the risky thing, such as no longer storing a field.
- Transfer: share the cost, for example with insurance or a provider's contract. The responsibility to people stays with you.
-
Accept: a named owner agrees to live with it, in writing, until a review date.
-
Residual risk is what's left after the treatment.
📝A worked example
Input: three risks for AarogyaDesk. Password guessing on the login page, a stolen backup on an unencrypted USB drive, the server failing on a weekday.
Steps:
- Rate them. Password guessing: likelihood 4, impact 4, score 16. Stolen backup: 2 and 5, score 10. Server failure: 3 and 3, score 9.
- Choose treatments. Guessing: reduce with lockouts and multi-factor login. Backup: reduce with encryption. Server: reduce with a tested restore and accept a few hours' downtime.
- Name owners and review dates.
Expected output: a register of three rows, ordered by score, each with a treatment and an owner. These ratings are illustrative.
🌍Where it's used
- ISO 27001 expects a risk assessment and a risk treatment plan.
- Boards and owners read risk registers to decide budgets.
- Insurers ask about the top risks before offering cyber insurance.
📝Case scenario
A small accounting firm listed 40 risks and tried to fix them all in one month, finishing none. When it ranked them and fixed the top five first, backups and multi-factor login were in place within two weeks.
🖱️Try it
Rate these four risks for a clinic from 1 to 5 for likelihood and impact: a phishing email to reception, a power cut, a lost staff laptop, a flaw in the booking search. Success: they're ordered, and you can explain your top choice in one sentence.
⚠️Common mistakes
- Scores without reasons. Sign: numbers with no notes. Fix: write one line on why each score was chosen.
- Accepting risk with nobody named. Sign: "accepted" with no owner. Fix: a person with authority signs it off.
- Thinking insurance removes the problem. Sign: "transferred, done". Fix: patients are still harmed, and the duty stays.
🛠️For your project
Project 1's findings use the same idea: each one has a severity, and the report puts the most serious first.
✅Quick check
A risk has likelihood 2 and impact 5. Another has likelihood 4 and impact 4. Which comes first by score?
Show the answer
The second: 16 against 10.
What does accepting a risk require?
Show the answer
A named owner with authority, a written reason and a review date.