Risk assessment in practice
Using the ISO/IEC 27005 and NIST SP 800-30 approaches you run an asset, threat and vulnerability based risk assessment, write scenarios, evaluate controls and prepare a risk report that drives decisions.
Level 201 · 19 lessons · 15 practice labs
Lessons
Preparation
- Approaches: asset-based and scenario-based
- ISO/IEC 27005 and NIST SP 800-30
- Scope and risk acceptance criteria
- Quick task: an assessment charter
Identification
- Valuing assets: confidentiality, integrity, availability
- Threat catalogues and threat intelligence
- Vulnerability sources: scans, audits, processes
- Writing risk scenarios
- Running interviews and workshops
- Quick task: turn interview notes into scenarios
Analysis and evaluation
- Evaluating existing controls
- Consistent scoring and calibration
- Aggregating and ranking risks
- Comparing against acceptance criteria
- Quick task: score a twenty-line register
Outcome
- Choosing treatment and cost–benefit
- Risk acceptance forms and exceptions
- The risk assessment report
- Capstone: a risk assessment for an online shop
Practice labs
- Choose the approach: asset or scenario: For six assessment needs, choose the asset-based or scenario-based approach and justify it.
- Write an assessment charter: Write an assessment charter for an online shop covering scope, method, participants, schedule and outputs.
- Define the risk acceptance criteria: From management's spoken expectations, derive written acceptance criteria with score thresholds, approval authority and time limits.
- Value assets for C, I and A: Assign confidentiality, integrity and availability values to ten assets using the given scale.
- Pick the relevant threats from a catalogue: For five assets of a courier company, select the applicable threats from a catalogue and state why they apply.
- Combine the vulnerability sources: From a scan summary, an audit report and a process observation, produce one de-duplicated vulnerability list.
- Complete the missing part of the scenario: Complete the missing source, event or consequence in eight risk scenarios.
- Turn interview notes into scenarios: Write six risk scenarios from the notes of an interview with a warehouse manager.
- A workshop agenda and question set: Prepare an agenda, participant list and fifteen questions for a two-hour risk workshop with Ayçiçeği Gıda's production planning unit.
- Rate the existing controls: Rate ten controls as effective, partly effective or ineffective from the evidence given.
- Score a twenty-line register: Score twenty risks using the scale definitions, rank them and mark those above the acceptance criteria.
- Calibrate inconsistent scores: Compare three assessors' differing scores for the same ten risks and write the reasons for the spread and the agreed score.
- Check a risk acceptance form: Mark the missing expiry, approver, rationale and compensating control in four risk acceptance forms.
- Choose treatment by cost and benefit: For five risks, compare the cost and expected risk reduction of three options each and justify your choice.
- Executive summary of the assessment report: From an online shop's completed register, write a two-page summary with the method, the top five risks and recommended decisions.
About this course
Using the ISO/IEC 27005 and NIST SP 800-30 approaches you run an asset, threat and vulnerability based risk assessment, write scenarios, evaluate controls and prepare a risk report that drives decisions.
What you will learn
- Preparation
- Identification
- Analysis and evaluation
- Outcome
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.