Cyber Security and Security Risk Analysis

What is Security Risk Analysis? (In Simple Words)

No company has infinite money to buy every security tool in the world. You would never spend ₹10 Lakhs on a Titanium bank vault just to protect a ₹500 plastic calculator!

Security Risk Analysis (or Risk Assessment) is the systematic process of identifying an organization’s valuable assets, finding the security weaknesses (vulnerabilities) and threats facing those assets, calculating how much damage an attack would cause, and choosing cost-effective security controls to reduce that risk.

1. The 5 Essential Terms of Risk Analysis (Must Memorize!)

Students often mix up Threat, Vulnerability, and Risk. Let’s understand them using a simple House Robbery Analogy:

How Threat, Vulnerability & Asset Combine to Create Risk

💎 AssetWhat you want to protect (e.g., Database / Gold)

🔓 VulnerabilityWeakness in defense (e.g., Broken Lock / Unpatched OS)

🦹 ThreatDanger that exploits weakness (e.g., Thief / Hacker)

⚠️ RISKLikelihood & Impact of Loss!

Asset: Anything of value owned by the organization that needs protection (e.g., Customer database, web servers, source code, laptops, company reputation).
Vulnerability (Weakness): A flaw, bug, or gap in a system’s security that could be exploited (e.g., an unlocked window, an unpatched Windows server, or a weak password like 123456).
Threat (Danger): Any person, malware, or natural event that can exploit a vulnerability to harm an asset (e.g., a hacker, ransomware, or a flood).
Risk: The probability (likelihood) that a Threat will successfully exploit a Vulnerability and the resulting financial/operational Impact on the Asset:

Formula: Risk = Threat × Vulnerability × Asset Value
Countermeasure (Control / Safeguard): A security step taken to fix a vulnerability or block a threat (e.g., installing a Firewall, enabling 2FA, or taking daily backups).

2. Step-by-Step Process of Security Risk Analysis

Every standard Security Risk Analysis follows 5 logical steps:

5-Step Security Risk Analysis Process

STEP 1Asset Identification & Valuation

List all hardware, software & data assets and assign their business value

STEP 2Threat & Vulnerability Identification

Find what dangers exist (hackers, fire, malware) and where system flaws are

STEP 3Risk Assessment (Likelihood × Impact)

Calculate Qualitative (High/Med/Low) or Quantitative (₹ ALE) risk

STEP 4Risk Treatment / Control Selection

Choose whether to Mitigate, Avoid, Transfer, or Accept each risk

STEP 5Continuous Monitoring & Review

Regularly re-evaluate as new cyber threats appear

3. Types of Risk Analysis: Qualitative vs. Quantitative

Organizations measure risk using two methods:

1. Qualitative Risk Analysis (Subjective / Category-Based)

Does not use complex math or exact rupee amounts.
Instead, experts rate Likelihood (Low, Medium, High) and Impact (Low, Medium, Critical) using a Risk Matrix:

Likelihood \ Impact	Low Impact	Medium Impact	High / Critical Impact
High Likelihood	Medium Risk	High Risk	CRITICAL RISK (Fix Immediately!)
Medium Likelihood	Low Risk	Medium Risk	High Risk
Low Likelihood	Low Risk	Low Risk	Medium Risk

2. Quantitative Risk Analysis (Numerical / Financial Formulas)

Uses exact monetary values (₹ or $) to calculate the expected financial loss per year:

AV (Asset Value): Total cost/value of the asset (e.g., Server value = ₹10,00,000).
EF (Exposure Factor): Percentage of the asset destroyed by a single attack (e.g., 50% = 0.5).
SLE (Single Loss Expectancy): Financial loss from a single security incident:

Formula: SLE = Asset Value (AV) × Exposure Factor (EF)
ARO (Annualized Rate of Occurrence): How many times the attack is expected to happen in 1 year (e.g., once every 2 years = 0.5).
ALE (Annualized Loss Expectancy): Total expected financial loss per year:

Formula: ALE = SLE × ARO

📝 Quick Solved Example:

Suppose a company’s E-commerce Server is worth AV = ₹10,00,000.
A DDoS attack causes 20% (EF = 0.20) loss:

Formula: SLE = 10,00,000 × 0.20 = ₹2,00,000 per attack
If such an attack happens twice a year (ARO = 2):

Formula: ALE = 2,00,000 × 2 = ₹4,00,000 per year
Decision: Since the company stands to lose ₹4,00,000/year, spending ₹50,000/year on Cloudflare Anti-DDoS protection is a smart investment!

4. The 4 Risk Management / Treatment Strategies

Once a risk is identified, management can handle it in 4 ways:

Risk Mitigation (Reduction): (Most Common) Installing security controls (Firewalls, Encryption, Antivirus, Backups) to reduce the likelihood or impact of the risk.
Risk Avoidance (Termination): Completely stopping the risky activity (e.g., shutting down an old, vulnerable FTP server that is no longer needed).
Risk Transference (Sharing): Shifting the financial risk to a third party—such as buying Cyber Insurance or outsourcing payment processing to Razorpay/Paytm.
Risk Acceptance (Retention): If the cost of fixing a tiny risk is higher than the potential loss itself, management documents and accepts the minor residual risk.

💡 DAVV Exam Preparation Tips

10-Mark Question: “What is Security Risk Analysis? Explain its steps, key terms (Asset, Threat, Vulnerability, Risk), and Risk Management strategies.”

Write the formula: Risk = Threat × Vulnerability × Asset Value.

Draw the 5-step Risk Analysis process diagram.

Show the Quantitative formulas (SLE = AV × EF and ALE = SLE × ARO) with the simple ₹ example.

Explain the 4 Risk Treatment Strategies: Mitigation, Avoidance, Transference, and Acceptance.

Security Risk Analysis: Process, ALE Formula & Risk Management