Risk assessment: assets, likelihood and the numbers behind SLE, ARO and ALE

No one can protect everything equally. A family, a small business and a hospital all have limited time and money, and every security decision is really a choice about where to spend them. Risk assessment is the discipline that makes those choices explicit: what could go wrong, how likely is it, how bad would it be, and is the protection worth its cost?

NIST’s guide to conducting risk assessments (SP 800-30) describes risk as a combination of the likelihood that a threat exploits a vulnerability and the impact if it does. Both halves matter. A catastrophic event that is extremely unlikely may deserve less attention than a moderate one that happens every month.

Step 1: know your assets

An asset is anything of value that could be harmed: devices, data, accounts, services, reputation, even people’s time. Start with a simple inventory and, for each item, note what it is worth and what losing it would cost. For data, think in the three classic properties from the CIA triad: confidentiality (could it leak?), integrity (could it be altered?) and availability (could it become unreachable?). A client database may be worth little if it goes offline for an hour, but a great deal if it is published.

Step 2: threats and vulnerabilities

A threat is something that could cause harm: a criminal group, a careless employee, a flood, a failing disk. A vulnerability is a weakness a threat could use: an unpatched server, a reused password, a single copy of important files. Risk exists where a threat meets a vulnerability and an asset. Structured threat modeling, covered in depth in the “Threat modeling and risk” course on FireAI University, is the systematic way to find these combinations.

Step 3: put numbers on it (quantitative risk)

When you have reasonable data, a few standard formulas turn risk into money, which makes it easy to compare with the cost of a control:

A worked example

A small design studio keeps its project files on one file server. Rebuilding and recovering from a ransomware attack would cost, in lost work, recovery time and client penalties, about 60,000 in value (AV). The studio estimates that an attack would destroy about half of that value (EF = 50%), so SLE = 60,000 × 0.5 = 30,000. Based on its size and sector, it estimates one such incident every four years (ARO = 0.25). ALE = 30,000 × 0.25 = 7,500 per year.

Now compare. An offline backup routine plus endpoint protections costs, say, 2,000 per year and would cut the exposure factor to 10% (restoring from backup instead of rebuilding). The new SLE is 6,000, the new ALE 1,500. The control saves 6,000 a year in expected loss for 2,000 of cost: a clear case. That arithmetic, however rough, is how security spending becomes a business decision instead of a guess.

Qualitative risk: when numbers are not available

Often you cannot price an asset or know how often an attack will happen. Qualitative assessment rates likelihood and impact on simple scales, such as low, medium and high, and places each risk on a matrix. High likelihood and high impact go to the top of the list. SP 800-30 supports both approaches and many organisations combine them: qualitative ratings to sort dozens of risks, numbers for the few that need a budget decision.

Step 4: decide what to do

• Mitigate: reduce likelihood or impact with a control (patching, MFA, backups).
• Transfer: share the cost with someone else, for example through cyber insurance or a contract.
• Avoid: stop the risky activity altogether, such as retiring an old public service.
• Accept: consciously live with a risk whose cost is below the cost of controlling it, and write that decision down.

Risk assessment is never finished. New assets arrive, threats change and controls age. Revisit the list at least once a year and after any significant incident or change.