[Figure: FiveStudy logo]
FiveStudy
Cybersecurity · Unit 2 · 2.1.d
AP Cybersecurity · Securing Spaces
The Risk Assessment Process
Threat, vulnerability, asset — all three, scored by likelihood and severity.
key ideaRisk exists when a threat can exploit a vulnerability to compromise an asset. All three, or there is no risk.
The stages
A risk assessment is not a list of scary possibilities. It is a structured argument that a specific threat could use a specific vulnerability against a specific asset — scored so that limited money goes to the right places first.
Both halves are required. A catastrophic outcome that nobody would ever attempt scores low, and so does a trivial nuisance that happens constantly. Risk is the product, not either factor.1
Inventory the assets
An asset is anything valuable: financial resources, intellectual property, data, digital infrastructure, physical property, and reputation. You cannot protect what is not on the list.
in the organization out a valued asset list
2
Identify threats and vulnerabilities
For each asset: who would want it, and what weakness would they use? A vulnerability with no plausible threat is not yet a risk.
out threat–vulnerability pairs
3
Score the likelihood
Driven by the value of the target and the difficulty of the exploit. Well-documented exploits raise likelihood sharply, because low-skilled adversaries can then use them.
out a likelihood rating
4
Score the severity
Usually measured in financial cost, which should also absorb reputational and operational impact. Downtime and lost trust are costs even when no data moves.
out a severity rating
5
Combine and document
Report quantitative (a 1–10 scale, or an annual figure) or qualitative (low / medium / high / severe). Documentation records the asset and its value, the likely threats, and how each vulnerability would be exploited.
out a ranked, defensible register
| Term | Definition | Test |
|---|
| asset | anything valuable to the organization | would losing it cost money, time or trust? |
| threat | someone or something that could cause harm | who would want to, and why? |
| vulnerability | a weakness that could be exploited | what specifically is weak? |
| risk | threat + vulnerability + asset, together | missing any one means no risk |
| likelihood | how probable the exploit is | target value × ease of exploitation |
| severity | how much damage results | financial, reputational, operational |
Row 4 is the definition students most often lose marks on. A vulnerability by itself is not a risk — there must be a threat that would use it, and an asset worth compromising.
Applying it
Quantitative scoring gives comparable numbers and demands data you may not have. Qualitative scoring is faster and defensible but harder to compare across teams. Most organizations use qualitative bands with a written justification for each.
| Quantitative | Qualitative |
|---|
| output | a number — 1–10, or $10,000 annual risk | a band — low / medium / high / severe |
| strength | comparable and rankable | fast, needs no loss data |
| weakness | requires data you may not have | depends on judgment |
| good for | budget cases, insurance | first passes, physical assessments |
Either is acceptable to the CED. What is not acceptable is a score with no written reasoning — documentation is what makes an assessment reviewable later.
Worked analysis
EX 1
Assemble a risk statement
A lab keeps prototype designs on a shared drive. The building's rear door is propped open in summer. Write the risk.
1
Name the asset and its value
Prototype designs — intellectual property, high value.
2
Name the vulnerability
An unsecured rear entrance with no badge control.
3
Name the threat
A competitor or a criminal organization seeking IP to sell.
4
State how it would be exploited
Walk in, reach an unattended workstation, copy files to a drive.
5
Write the risk
A threat actor could exploit the propped rear door to reach workstations and steal prototype IP — asset, vulnerability, threat, mechanism, all four present.
EX 2
Score likelihood honestly
Two vulnerabilities: (A) a public web server missing a patch with a published exploit; (B) a research laptop needing physical access and a zero-day. Which has higher likelihood?
1
Apply the value factor
Both targets are valuable, so this does not separate them.
2
Apply the difficulty factor
(A) has a documented exploit usable by low-skilled adversaries; (B) needs physical access and original research.
3
Compare
(A) is far more likely — the pool of capable attackers is enormously larger.
4
Note the severity may reverse
(B) might be worse if it happened. Likelihood and severity are independent.
5
Combine
Rank by both together, and expect (A) to lead on the combined score.
EX 3
Severity beyond the invoice
A ransomware incident is contained with no data stolen. The organization is offline for three days. Is severity low?
1
Count the direct cost
Response, overtime, replacement hardware.
2
Count the operational impact
Three days of lost production, missed deliveries, contractual penalties.
3
Count the reputational impact
Customers who learned the organization was down, and regulators who now ask questions.
4
Reject the initial reading
No data loss does not mean low severity.
5
State the rule
Severity is financial cost including reputational and operational impact — not just the value of anything stolen.
Check yourself
State the CED definition of risk.
Show answer
Risk occurs when a threat can exploit a vulnerability to compromise an asset. Remove any one of the three and there is no risk to assess.
Which two factors does a risk assessment consider?
Show answer
The likelihood of an attack against a specific vulnerability, and the severity of the projected damage from that attack.
Name two things that raise likelihood.
Show answer
A valuable target — adversaries prefer what they perceive as worth taking — and a low difficulty of exploitation, especially where the exploit is well documented.
What must risk assessment documentation include?
Show answer
Vulnerable assets and their value, descriptions of likely threats, and the specific vulnerabilities and how they would be exploited.