Vulnerability Assessment and Risk Management · Topic 3 of 4
Risk Management, Risk Levels and Data Classification
Learn how risk differs from a vulnerability, how risks are ranked, the four ways to treat risk, data classification and IT security assessments.
- 5 min
- Risk is likelihood combined with impact, and a vulnerability is only the weakness.
- The risk levels are low, medium, high and extremely high.
- The four treatments are avoid, mitigate, transfer and accept.
What it is
Risk management is the process of deciding which risks matter most and what to do about each one.
You cannot remove every risk, and you do not have unlimited money. So organisations list their risks, rank them, and choose sensible responses.
This page covers how to rank risk, the four ways to respond, how data classification guides protection, and the assessments that check IT systems.
How it works
Risk work is a loop of finding, rating, treating and reviewing.
Vulnerability versus risk
A vulnerability is a weakness. Risk is the chance that the weakness is used and the harm that would follow. The same vulnerability can be a high risk on one system and a low risk on another.
Think of an unlocked door. In a busy street with valuable goods inside, it is a high risk, but in a locked yard with nothing inside, it is a low risk.
Ranking risks and levels of risk
Risk depends on two things: how likely it is and how large the impact would be. A simple grid combines the two.
| Likelihood | Low impact | Medium impact | High impact |
|---|---|---|---|
| Low | Low | Low | Medium |
| Medium | Low | Medium | High |
| High | Medium | High | Extremely high |
The usual levels are low, medium, high and extremely high. Risks at the top need action first.
There are two styles of rating:
- Qualitative uses words and levels such as low, medium and high. It is quick and easy to understand.
- Quantitative uses numbers, usually money. A common formula is annualised loss expectancy (ALE), which equals the single loss expectancy (SLE) multiplied by the annual rate of occurrence (ARO).
Approaches to treat risk
| Approach | Meaning | Example |
|---|---|---|
| Avoid | Stop the activity that creates the risk | Do not store card numbers at all |
| Mitigate (reduce) | Lower the likelihood or the impact | Patch the server, add a firewall |
| Transfer (share) | Move some of the loss to another party | Buy insurance, use a provider |
| Accept | Decide to live with it | A very small risk that costs more to fix than it could cause |
Acceptance must be a conscious decision by someone with authority, and it should be recorded. What is left after treatment is called residual risk.
Mitigation strategies are the controls used to reduce risk. They include technical controls such as patching, encryption and segmentation, administrative controls such as policies and training, and physical controls such as locks. Using several at once follows defence in depth.
Data classification
Data classification sorts data into levels by how sensitive it is, so each level gets the right protection. A typical commercial scheme is:
| Level | Meaning |
|---|---|
| Public | Safe to share with anyone |
| Internal | For staff only, low harm if leaked |
| Confidential | Harm to the business or people if leaked |
| Restricted | Highest protection, serious harm if leaked |
The names differ between organisations. Governments often use levels such as unclassified, confidential, secret and top secret.
Some data types carry special risk. Personal data about people, health records, payment card data and trade secrets can lead to fines, lawsuits and lost trust if exposed. The higher the classification, the stronger the access control, encryption and monitoring should be.
Security assessments of IT systems
A security assessment is a structured review of how well a system or process is protected. Four areas named in the syllabus are:
- Information security: are the controls that protect the confidentiality, integrity and availability of data in place and working?
- Change management: are changes to systems requested, approved, tested and recorded, so that a change does not create a new weakness?
- Computer operations: are the day to day running tasks, such as backups, job scheduling and monitoring, done reliably and securely?
- Information assurance: is there confidence that information is protected and trustworthy, and that the risks to it are managed?
The results are written up, with findings ranked by risk and recommended fixes.
What to remember for the exam
Seven facts cover most questions on this topic.
- Risk is likelihood combined with impact, and a vulnerability is only the weakness.
- The risk levels are low, medium, high and extremely high.
- The four treatments are avoid, mitigate, transfer and accept.
- Residual risk is what remains after controls are applied.
- Qualitative ratings use levels, and quantitative ratings use numbers such as ALE.
- Higher classified data needs stronger protection.
- Assessments cover information security, change management, computer operations and information assurance.
Insurance is transfer, not mitigation. Doing nothing on purpose, and recording it, is acceptance.
Common mistakes
These four errors are common.
Treating vulnerability and risk as the same thing. Risk needs a threat, a likelihood and an impact.
Accepting risk without a record. Ignoring a risk is not acceptance unless it is a recorded decision.
Classifying everything as top level. Too many protected items makes protection costly and hard to follow.
Skipping change management. Uncontrolled changes are a common way to create new weaknesses.
Risk ranking is a judgement, so different people can reach slightly different levels. Write down the reasons.
Check yourself
Work through these three questions.
What are the four ways to treat risk?
Avoid, mitigate, transfer and accept.
Why is buying insurance an example of transfer?
It moves part of the financial loss to another party, but the risk itself still exists.
What does a high likelihood and a high impact give?
An extremely high risk level, which should be treated first.
Topic 3 of 4 in Vulnerability Assessment and Risk Management
Test yourself on Vulnerability Assessment and Risk Management
The full Cisco CCST 100-160 Cybersecurity question bank has 864 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.