Security Risk Assessment Methods: Quantitative or Qualitative Analysis?

Risk assessment forms the foundation of an effective information security strategy. As a CISSP candidate or cybersecurity professional, you need to understand when to use qualitative analysis and when to rely on quantitative calculations. Choosing the right risk assessment method can significantly impact your security posture.

This guide introduces the two primary approaches to risk assessment: qualitative and quantitative. While the CISSP exam doesn't require you to be a risk assessment expert, a solid grasp of these concepts is essential. We'll explore how these methods integrate with critical processes like threat identification and comprehensive security risk assessment.

Let's examine how these approaches shape modern cybersecurity practices and prepare you for the challenges ahead in your CISSP journey.

What is a Security Risk Assessment?

Risk assessment is a crucial process in information security that evaluates the likelihood, consequences, and tolerances of potential incidents. It serves as a fundamental component of a comprehensive risk management strategy, aiming to implement control measures that mitigate or eliminate potential risk-related consequences.

The primary objectives of risk assessment are twofold: to prevent negative outcomes associated with identified risks and to recognize and evaluate potential opportunities.

Effective risk assessment involves two key elements:

• Identifying and analyzing potential future events that could adversely impact individuals, assets, processes, or the environment.
• Making informed judgments about risk management and tolerance based on thorough analysis and consideration of influencing factors.

The Risk Assessment Approach

Risks are identified by determining the specific threats (threat analysis) that could harm the asset, the vulnerabilities (vulnerability analysis) of the asset, what the impact would be if a threat manifests or a vulnerability is exploited, and the expected frequency of the risk occurring. Simple definitions of the four key components that must be identified as part of risk analysis follow:

• Threat: Any potential danger to an asset (could be environment, physical, people, technology).
• Vulnerability: Any weakness that exists that could be exploited by an attacker.
• Impact: The extent to which an asset would be negatively affected.
• Probability/likelihood: The chance that a risk might materialize due to a given threat or vulnerability being present.

Based upon the findings from the risk analysis step, the next step is to rank the assets in order of the ones presenting the most risk to those with the least risk, using quantitative or qualitative analysis.

Qualitative Analysis

Qualitative analysis is a fundamental approach in risk assessment, primarily aimed at identifying risks that require detailed analysis and determining necessary controls based on their potential impact on organizational objectives. This method relies on descriptive scales and expert judgment rather than precise numerical values.

It is characterized by its subjective evaluation, typically categorizing risks using terms like "high," "medium," and "low." It's often scenario-based, involving the analysis of potential risk situations and their outcomes. Two widely recognized and easily applied methods in qualitative risk analysis are:

• Keep It Super Simple (KISS): This one-dimensional technique is ideal for small projects or narrow-framed assessments. It's particularly useful when unnecessary complexity should be avoided, or when the assessing team lacks experience in risk evaluation. The KISS method involves rating risks on a basic scale (e.g., very high/high/medium/low/very low).
• Probability/Impact Matrix: This two-dimensional approach evaluates both the probability of a risk occurring and its potential impact. The impact typically considers factors like schedule, cost, scope, and quality. Risks are rated on a numeric scale (e.g., 1 to 5 or 1 to 10), with the risk score calculated by multiplying probability and impact.

Application and Benefits

Qualitative analysis offers several advantages in risk assessment:

• Rapid Assessment: It's generally quicker to perform than quantitative analysis, allowing for swift identification of risk areas in normal business functions.
• Stakeholder-Friendly: Results are easy to communicate to non-technical stakeholders, facilitating broader understanding across an organization.
• Versatility: It can be applied to virtually all types of business risks and is particularly useful for complex threats that are difficult to quantify.
• Initial Screening: Qualitative analysis serves as an excellent first step in risk assessment, helping to prioritize which risks may require more detailed quantitative analysis.

A common tool in qualitative analysis is the risk matrix, which visually represents risks based on their likelihood and potential impact, aiding in prioritization and resource allocation.

Limitations and Considerations

While qualitative analysis is often the first choice due to its ease of application, it's important to recognize its limitations:

• Subjectivity can lead to inconsistencies in risk evaluation.
• The lack of numerical data can make detailed cost-benefit analyses challenging.
• For critical decisions or complex tasks, the results may not provide sufficient detail.

In such cases, following up with quantitative analysis might be necessary to gain more objective information and accurate data. However, if the qualitative analysis results are deemed sufficient, there's no need to conduct a quantitative analysis for every identified risk.

The Role in Overall Risk Assessment

Qualitative risk analysis plays a crucial role in the broader risk management process. It serves as an efficient method for initial risk identification and prioritization. The insights gained from qualitative analysis can guide further investigation, helping determine which risks warrant more detailed quantitative analysis.

Moreover, qualitative analysis can assess how identified risks align with people's concerns about their jobs or other business functions. This human-centric aspect of qualitative analysis makes it particularly valuable in understanding and addressing stakeholder perceptions of risk.

Quantitative Analysis

Quantitative risk analysis is a more detailed approach to evaluating risks, aiming to assign objective numerical values to various components of the risk assessment process. Its primary purpose is to provide measurable, data-driven assessments of potential losses and the probability of risk occurrence, offering more precise information for decision-making.

This type of analysis is characterized by its use of numerical data and statistical techniques to evaluate risks. Unlike qualitative analysis, which relies on descriptive scales, quantitative methods employ concrete numbers and mathematical models. The primary method in quantitative risk analysis is the Annual Loss Expectancy (ALE) calculation.

Annual Loss Expectancy (ALE) Calculation: ALE = SLE (AV x EF) x ARO

This fundamental method combines these components:

• Asset Value (AV): The cost of the asset in monetary value, e.g., a CCTV system that costs $2,000.
• Exposure Factor (EF): Measured as a percentage and expresses how much of the asset’s value stands to be lost in case of a risk materializing, e.g., if the voltage spikes excessively during certain periods of the year, a CCTV might lose three cameras to damage, thus costing $200. This represents 10 percent of the total cost (which is $2,000) and thus makes the EF be 10 percent. The EF will always be a percentage between 0 to 100 percent.
• Single Loss Expectancy (SLE): Denotes how much it will cost if the risk occurs once. To calculate the SLE, simply multiply the AV by the EF: SLE = AV * EF, which in this example becomes $2,000 * 10 percent = $200.
• Annualized Rate of Occurrence (ARO): Denotes how many times each year the risk is expected to occur. For example, if the voltage spikes excessively three times a year, the ARO is 3.
• Annualized Loss Expectancy (ALE): Expresses the annual cost of the risk materializing. To calculate it, use the following formula: ALE = SLE * ARO, which in this example becomes $200 * 3 = $600.

The ALE is a very useful figure, as it shows exactly how much money a given risk is expected to cost the organization per year, and can therefore provide guidance on what controls are cost-justified and should be put in place.

It is not a good business practice to implement controls that cost more than the risk they are meant to mitigate. If the cost of a control is more than the cost of the risk, a good business decision would be to accept the risk. Owners of an asset are best positioned to make this risk acceptance decision.

While the results of the ALE calculation are extremely useful, and quantitative analysis is highly preferred over qualitative analysis, it’s extremely difficult to perform this calculation. Most of the numbers you need are quite difficult to assess accurately.