KIRIRI WOMEN’S UNIVERSITY OF SCIENCE AND TECHNOLOGY
Week 6: Inherent Risk Analysis
Part I: Understanding Inherent Risk
1. Introduction: What Is Inherent Risk?
Inherent risk is arguably the most crucial starting point in any risk assessment. It is defined as
the level of risk that exists before any security controls, safeguards, or mitigation measures are
applied. Think of it as the "raw" exposure an organization faces if it were running its operations
with no protection in place.
Why Inherent Risk Matters:
Establishes a Baseline: It provides a clear, objective starting point for measurement.
True Magnitude: It helps decision-makers understand the worst-case scenario—the true
magnitude of loss if all existing controls were to fail or didn't exist.
Benchmarking: It is essential for accurately comparing against residual risk (the risk
that remains after controls are applied) to measure the effectiveness of the security
program.
2. Components of Inherent Risk
Inherent risk is conceptually calculated by multiplying two primary dimensions: Likelihood and
Impact.
Inherent Risk = Likelihood x Impact
a. Likelihood (Probability of Occurrence): Likelihood describes how probable it is that a
specific threat will successfully exploit a vulnerability in a given timeframe.
Factors that affect Likelihood:
Frequency of Threat Activity: How often does the threat actor (e.g., phishing campaign,
malware) target the organization or industry?
Ease of Exploitability: How technically difficult is it to exploit the vulnerability? A
high-CVSS-scored vulnerability is generally easier to exploit.
Exposure of Asset: Is the asset directly connected to the internet (high exposure) or
isolated on an internal network (low exposure)?
Expression of Likelihood:
Qualitative Terms: Rare, Unlikely, Possible, Likely, Almost Certain.
DSE 1005: CYBERSECURITY RISK ASSESSMENT Page |1
KIRIRI WOMEN’S UNIVERSITY OF SCIENCE AND TECHNOLOGY
Quantitative Terms (for advanced models): Percentages, or the Annual Rate of
Occurrence (ARO), which estimates how many times a loss event is expected to occur
per year.
b. Impact (Consequences of Occurrence): Impact describes the extent of harm or damage if
the threat successfully materializes. This is assessed based on the business value of the asset
identified in Week 4.
Types of Impact:
Financial: Direct costs (fines, regulatory penalties, legal fees) and indirect costs (revenue
loss, remediation).
Operational: System downtime, disruption, and loss of productivity.
Reputational: Negative media coverage, loss of customer trust, and long-term brand
damage.
Legal/Compliance: Sanctions or penalties for violating specific laws (e.g., GDPR,
HIPAA).
Measurement of Impact:
Qualitatively: Low, Medium, High, Critical.
Quantitatively: Estimated monetary value of losses (e.g., the dollar value of lost revenue
per hour of downtime).
Part II: Risk Quantification Methods
3. Risk Assessment Methods
The method chosen dictates how Likelihood and Impact are measured and combined.
a. Qualitative Risk Assessment:
Description: Uses descriptive categories instead of numerical values. It relies heavily on
expert judgment, consensus, and historical experience.
Advantages: Easiest and quickest to implement; intuitive for business stakeholders;
highly useful when reliable data for quantification is unavailable.
Disadvantages: Subjective and inconsistent; risks can be difficult to compare across
different business units (e.g., is "High" risk in Finance the same as "High" risk in HR?).
Example: Likelihood is scored as "Possible," and Impact is scored as "High." The overall
risk is then assessed qualitatively as "High."
b. Quantitative Risk Assessment:
DSE 1005: CYBERSECURITY RISK ASSESSMENT Page |2
KIRIRI WOMEN’S UNIVERSITY OF SCIENCE AND TECHNOLOGY
Description: Uses numerical values and financial models to measure risk in monetary
terms, providing a concrete Return on Investment (ROI) for security expenditures.
Key Metrics (used heavily in the FAIR framework):
o Single Loss Expectancy (SLE): The estimated monetary loss resulting from a
single occurrence of a threat event.
o SLE = Asset Value x Exposure Factor (EF)
(The Exposure Factor is the percentage of the asset's value that is lost due to the
event.)
o Annual Rate of Occurrence (ARO): The estimated frequency of the event
occurring within a one-year period.
o Annual Loss Expectancy (ALE): The expected yearly financial loss due to a
specific risk. This is the ultimate quantification of risk.
o ALE = SLE x ARO
Advantages: Provides concrete financial justification for security investments;
supports rigorous cost-benefit analysis.
Disadvantages: Requires reliable, complex data; can be time-consuming and resource-
intensive.
c. Hybrid (Semi-Quantitative) Approach:
Description: The most common approach. It combines qualitative scales (e.g., "Likely"
or "High") with numerical scores (e.g., converting "Likely" to 4 and "High" to 5,
resulting in a risk score of 20).
Goal: To balance the ease of use of the qualitative method with the precision of the
quantitative method.
4. Using a Risk Matrix
A Risk Matrix is the quintessential visual tool for qualitative and hybrid assessments.
Definition: A grid that plots Likelihood (often on the X-axis) against Impact (on the Y-
axis) to determine the overall level of risk (Low, Medium, High, Critical).
Purpose: Enables quick prioritization and provides a simple, accessible format for
communicating risk to non-technical stakeholders (e.g., the Board of Directors).
DSE 1005: CYBERSECURITY RISK ASSESSMENT Page |3
KIRIRI WOMEN’S UNIVERSITY OF SCIENCE AND TECHNOLOGY
Impact ↓ / Likelihood → Rare Unlikely Possible Likely Almost Certain
Severe Medium High High Critical Critical
High Medium Medium High High Critical
Moderate Low Medium Medium High High
Low Low Low Medium Medium High
Insignificant Low Low Low Medium Medium
Class activity:
Scenario:
A financial institution is performing an inherent risk analysis on its core banking application,
which is internet-facing. This application handles sensitive customer financial transactions
(Asset Value: $50 million). You are assessing the inherent risk related to a successful SQL
injection attack (Threat/Vulnerability Pair).
Expert Analysis (Before Controls):
Likelihood: Because the application is internet-facing and handles high-value
transactions, expert opinion suggests a successful exploitation is Possible (estimated
ARO = 0.2).
Impact: If a successful SQL injection occurs, it would lead to a total compromise of the
customer data, potentially costing the organization 5% of the asset's value in remediation
and fines (Exposure Factor = 0.05).
Task:
1. Calculate the Single Loss Expectancy (SLE) for this risk.
2. Calculate the Annual Loss Expectancy (ALE) for this risk.
3. Based on the Qualitative Risk Matrix provided above, what is the equivalent inherent risk
level if "Possible" Likelihood is paired with "High" Impact?
DSE 1005: CYBERSECURITY RISK ASSESSMENT Page |4