Quantitative risk analysis: FAIR and Monte Carlo
You use the FAIR model to express risk in money, calibrate expert estimates as ranges and compute loss distributions and return on control investment with Monte Carlo simulation in Python.
Level 301 · 15 lessons · 12 practice labs
Lessons
Why quantitative
- The limits of heat maps
- The language of money: expected loss and uncertainty
- The FAIR taxonomy: frequency and magnitude
- Quick task: break a scenario into FAIR factors
Estimation
- Calibrated estimates and confidence ranges
- Sources of loss data
- Forms of loss: primary and secondary
- Quick task: range estimates for three scenarios
Simulation
- Monte Carlo simulation
- PERT and lognormal distributions
- The loss exceedance curve
- Return on control investment
- Quick task: simulate ransomware risk
Decision
- Presenting quantitative results to management
- Capstone: compare three investment options with loss curves
Practice labs
- Place the factor on the FAIR tree: Place twelve facts under threat event frequency, vulnerability, primary loss or secondary loss.
- Break a scenario into FAIR factors: Describe a customer database leak scenario with asset, threat, effect type and all the FAIR factors.
- Turn heat map entries into measurable scenarios: Rewrite three vague red risks as scenarios whose frequency and magnitude can be estimated.
- Give a ninety percent confidence range: Give range estimates for ten general knowledge questions and work out how many contain the true value.
- Range estimates for three scenarios: From the loss data and expert notes given, set minimum, most likely and maximum values for three scenarios, with reasons.
- Estimate primary and secondary loss: For an outage scenario, estimate the productivity, response, replacement, fines and reputation forms of loss as separate ranges.
- Read the simulation output: From a prepared simulation result, find the mean, the median and the ninetieth percentile and interpret each in a sentence.
- Simulate ransomware risk: Run a ten-thousand-trial Monte Carlo simulation with the given PERT ranges and summarise the annual loss distribution.
- Produce a loss exceedance curve: Produce the loss exceedance curve from the simulation result and report the probability of exceeding the risk appetite line.
- Calculate the return on a control: Calculate the return of three controls from expected loss before and after and the annual cost.
- Compare three investment options: Compare the simulation results of three options on average loss and tail loss and write a recommendation.
- Present the result to management: From a quantitative analysis output, write a one-page management note that states the assumptions, the uncertainty and the decision sought.
About this course
You use the FAIR model to express risk in money, calibrate expert estimates as ranges and compute loss distributions and return on control investment with Monte Carlo simulation in Python.
What you will learn
- Why quantitative
- Estimation
- Simulation
- Decision
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.