Information Security Risk Management · Topic 1 of 2
Threats, Vulnerabilities and Risk Assessment
The emerging threat landscape, threat intelligence, vulnerability and control deficiency analysis, and qualitative and quantitative risk assessment.
- 3 min
- Risk combines likelihood and impact of a threat exploiting a vulnerability.
- Threat intelligence must be translated into organizational impact.
- Control deficiencies need root cause analysis.
What it is
Risk assessment identifies what could harm the organization's information assets, how likely it is and how much damage it would do. It combines an understanding of the threat landscape (who or what could cause harm), vulnerabilities and control deficiencies (weaknesses that could be exploited) and the value of assets to the business.
How it works
Key terms
| Term | Meaning |
|---|---|
| Asset | Something of value: information, systems, people, reputation |
| Threat | Anything that could cause harm, such as attackers, insiders, failures or natural events |
| Vulnerability | A weakness that a threat could exploit |
| Likelihood | How probable it is that a threat exploits a vulnerability |
| Impact | The consequence to the business if it happens |
| Risk | The combination of likelihood and impact |
The emerging risk and threat landscape
Threats change with technology, geopolitics and the business itself: new attack techniques, ransomware groups, supply chain compromises, attacks on cloud services, misuse of AI, and changes such as mergers or new markets. The security manager keeps up through threat intelligence (commercial feeds, industry sharing groups, government advisories) and translates it into what it means for this organization's assets.
When the threat picture changes significantly, the manager reassesses the affected risks and adjusts controls, rather than waiting for the next scheduled assessment.
Vulnerability and control deficiency analysis
Sources include vulnerability scans, penetration tests, audit findings, control self-assessments, incident lessons and architecture reviews. A control deficiency is a control that is missing, poorly designed or not operating as intended. The manager looks for root causes, such as a broken process, not just individual findings.
Risk assessment approaches
| Approach | How | Strength | Limitation |
|---|---|---|---|
| Qualitative | Ratings such as high, medium, low from expert judgment | Fast, easy to communicate | Subjective; hard to compare costs |
| Quantitative | Monetary values and probabilities, such as annualized loss expectancy (ALE = single loss expectancy times annual rate of occurrence) | Supports cost-benefit decisions | Needs reliable data, which is often lacking |
| Semi-quantitative | Numeric scales for likelihood and impact | Repeatable ranking | Numbers can imply false precision |
Whatever the method, it must be consistent across the organization so risks can be compared and aggregated. Scenario-based analysis helps business owners understand what could actually happen.
Risk register
The risk register records each risk with its description, owner, rating, existing controls, treatment decision and status. It is the basis for reporting and for tracking changes over time.
The value of an asset, and so the impact of losing it, comes from the business. Ask the asset owner, not IT, how much an outage or disclosure would hurt.
How the exam asks about this
- "What should be done FIRST in a risk assessment?" Identify and value assets (and understand business context).
- "A new threat targets the organization's sector." Reassess the affected risks and controls.
- "Risk ratings differ wildly between departments." Apply a consistent methodology.
What to remember for the exam
- Risk combines likelihood and impact of a threat exploiting a vulnerability.
- Threat intelligence must be translated into organizational impact.
- Control deficiencies need root cause analysis.
- Qualitative is quick; quantitative supports cost justification.
- Use one consistent method and record results in a risk register.
Rating risks only by technical severity, such as a vulnerability score, ignores business impact and can send resources to the wrong place.
Common mistakes
Confusing threat and vulnerability. A threat exploits; a vulnerability is exploited.
Waiting for the annual cycle after a major change in threats.
Letting IT value business assets.
Check yourself
What is a vulnerability?
A weakness that a threat could exploit.
How is annualized loss expectancy calculated?
Single loss expectancy multiplied by the annual rate of occurrence.
Why must a risk assessment method be applied consistently?
So risks can be compared, prioritized and aggregated across the organization.
Topic 1 of 2 in Information Security Risk Management
Test yourself on Information Security Risk Management
The full ISACA CISM question bank has 1,044 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.