Risk Assessment

The two lessons before this one described adversaries and the phases of an attack. This lesson describes how a defender weighs the attacks an organization could face, a process called risk assessment. It builds one for a small company that designs board games and sells them online and at conventions.

An assessment starts from what the company holds. The table below lists every asset. The game in development hasn't shipped yet, so its files are valued by what the company has spent on them.

The company finds two weaknesses, and each gives a risk. Risk A comes from the online store's administrator sign-in, protected only by a six-character password that appears on published lists of common passwords, with no limit on failed sign-ins. That account can read the customer and order list and take the store offline.

Risk B comes from the folder of game files. It sits in cloud storage shared by a public link, so anyone holding the link can download the files without signing in. The link has been emailed to the illustrator and the printing factory.

In risk A, the threat is an adversary guessing passwords at the sign-in page. The vulnerability is a common password with no limit on failed attempts, and the asset is the store with its customer list. In risk B, the threat is anyone who obtains the link and copies the game. The vulnerability is a folder that asks no one to sign in, and the asset is the game's files.

Neither risk reaches the warehouse stock or the bank account, so they're set aside. Each of the two risks is weighed on two factors.

Everything about risk A points toward an attempt. The store brings in 180,000 dollars a year and holds 5,200 customer records, so adversaries see a target worth trying. Trying a published list of common passwords takes a free program and no expertise. And the adversaries a store like this draws, criminals after money and customer details, are motivated and have that program within reach.

Risk B scores differently on the same three factors. The game is valuable to a copier, since 1,600 backers have paid for it in advance. Opening a link takes no skill. The likely adversaries are a copier who wants to sell the game first and a fan who wants to post it early. Neither needs any capability beyond holding the link. The obstacle is obtaining it, since the link has reached only two outside parties.

So risk A is likely and risk B is possible. It's tempting to call B unlikely, since no adversary is known to hold the link. The folder keeps no record of who opens it, so the company would learn of a forwarded link only when copies appeared.

Suppose an adversary signs in as the store's administrator in late November. The store stays offline while a contractor rebuilds it for 3,000 dollars. Meanwhile 450 holiday orders miss the shipping date and are refunded at an average of 40 dollars, an operational impact of 18,000 dollars. Word of the break-in reaches the backers, and 100 cancel their pre-orders. That reputational impact is 100 × 55 = 5,500 dollars.

The total is 3,000 + 18,000 + 5,500 = 26,500 dollars. It's easy to count only the rebuild, which is under an eighth of the total. Even the total leaves something out: customers would have to be told their details were read, a cost the company can't yet put a number on.

Risk A has figures behind it, so the company rates it in dollars. From reports of takeovers at similar online stores, the owner expects one every two years. The company prices each at the holiday-rush figure of 26,500 dollars, so the annual risk is half that, 13,250 dollars a year.

Risk B has no such figures. Early copies would cut into sales of a game that cost 84,000 dollars to make, and backers who find them may cancel pre-orders. The operational impact is small, since the store and warehouse keep running. Nobody can say how many copies a leak would produce, so the company rates B in words, on a scale of minor, moderate, and serious. Its likelihood is possible and its damage could reach the whole investment in the game, so B is rated serious.

The assessment is written down one risk at a time. The entry below is for risk B.

Risk A's entry has the same five rows, and its rating reads "Quantitative: 13,250 dollars a year."