Identifying Risk in Daily Operations
Risk is not a vague concept; it is a measurable and calculable value in cybersecurity decision-making.
Risk = Likelihood × Impact
- Likelihood: The probability that a specific threat will exploit an existing vulnerability.
Example: The likelihood of receiving a phishing email is High.
- Impact: The magnitude of damage or harm that could result from a successful attack.
Example: The impact of a ransomware infection is Critical.
- Risk Acceptance vs. Mitigation: Organizations cannot eliminate all risk. Instead, they must decide which risks to accept (low likelihood / low impact) and which to mitigate (high likelihood / high impact).
Mitigation controls may include Multi-Factor Authentication (MFA), encryption, network segmentation, or security awareness training.