Information security risk (情報セキュリティリスク) is the possibility that a threat exploits a vulnerability and causes damage to an information asset.
Element
Meaning
Example
Information asset
Information worth protecting, and the equipment that handles it
Customer contact data
Threat
A cause of damage
Impersonation, equipment failure, flooding
Vulnerability
A weakness on the defender's side that a threat can exploit
Reusing the same password across services
A threat is an event that causes damage, and a vulnerability is a weakness on the defender's side that a threat can exploit. Either one alone rarely leads to damage, but the risk grows when both are present. Risk assessment is the activity of finding these risks, measuring their size and deciding whether they need treatment.
AnalogyPicture a neighborhood where burglars are active (the threat) and a house whose back-door lock is broken (the vulnerability). The chance that the family's belongings get stolen is itself the risk.
How to remember"Vulnerable" comes from the Latin word for a wound: it describes the side that can be hurt, the defender, not the side that attacks.
Exam points
ExamInformation security risk (情報セキュリティリスク) is the possibility that a threat (脅威) exploits a vulnerability (脆弱性) in an information asset (情報資産) and the organization suffers damage. A pairing that swaps the roles of threat and vulnerability does not hold.
ExamThreats include not only malicious attacks but also unintended events such as natural phenomena and equipment malfunctions. Misconfigurations and insufficient user training belong on the vulnerability side, not the threat side.
Risk assessment (リスクアセスメント) is a series of activities that runs three steps in order, risk identification, risk analysis and risk evaluation, to reveal which risks need treatment and in what priority.
Risk identification: find them
Risk analysis: estimate their size
Risk evaluation: compare with criteria and decide
Risk treatment (after the assessment)
With that result, move on to risk treatment, where specific countermeasures are chosen.
4 / 4
Risk assessment is the stage within risk management (リスクマネジメント), the organization's whole activity from examining risks to acting on them, where risks are examined before any action is taken. Its result shows which risks need treatment and which to tackle first.
AnalogyIt is like a home inspector who finds cracks and leaks, measures how bad each one is, and checks them against repair guidelines to report which ones are urgent.
Exam points
ExamRisk assessment (リスクアセスメント) covers three steps, risk identification (リスク特定), risk analysis (リスク分析) and risk evaluation (リスク評価), and does not include risk treatment (リスク対応). The assessment stops once treatment priorities are set, and choosing how to treat each risk is done in risk treatment.
ExamThe steps run from identification to analysis and from analysis to evaluation, with risk treatment after that. Evaluation never comes before analysis.
Risk identification (リスク特定) is the first step of risk assessment: finding and writing down the risks faced by the information assets to be protected.
You list the target information assets, combine the threats and vulnerabilities related to each, and describe what could happen. In an ISMS (the system by which an organization continuously manages information security), the targets are the information inside the scope (適用範囲) the organization has defined. A risk missed here is not handled in any later step either, so the net has to be cast wide.
AnalogyIt is like the stage before a trip when you jot down everything that could go wrong, such as losing your wallet, the trains stopping or the hotel booking falling through.
How to rememberIdentification is the word behind ID, as in an ID card. Link it to the stage where you first establish who or what is out there.
Exam points
ExamThe first step in risk assessment (リスクアセスメント) is risk identification (リスク特定), which uncovers what risks the organization has.
ExamIn ISMS risk identification, you uncover the risks that come with losing the three properties of confidentiality, integrity and availability for the information within the scope (適用範囲).
Risk analysis (リスク分析) is the step that estimates the likelihood and size of impact of each identified risk to set its risk level (how big the risk is).
Likelihood ＼ Impact
Low impact
High impact
Likely
Risk level: medium
Risk level: high
Unlikely
Risk level: low
Risk level: medium
Estimates can be quantitative, expressed as numbers such as an amount of loss, or qualitative, expressed as grades such as high, medium and low. Another method rates the asset value, threats and vulnerabilities of each asset to work out the size of the risk, and there asset value bears on impact while threats and vulnerabilities bear on likelihood.
AnalogyIt resembles sizing up how dangerous an approaching typhoon is by weighing whether it is likely to make landfall together with how much damage it would do if it did.
How to rememberAnalysis comes from the Greek for loosening something apart. Picture breaking each risk open to see what is inside and how big it is.
Exam points
ExamRisk analysis (リスク分析) sets each risk's risk level (リスクレベル) in a form that can be compared with criteria. The organization chooses methods that suit it, and no rule says every risk must use the same technique.
ExamAsset value (資産価値), threats and vulnerabilities together determine how big a risk is. With everything else equal, the higher an asset's value, the larger its risk.
Mix-upFinding risks and listing them is risk identification (リスク特定); giving each listed risk a size is risk analysis.
Risk evaluation (リスク評価) is the step that compares the risk levels found in analysis with the risk criteria to decide whether each risk needs treatment and in what order.
Risk criteria (リスク基準) are the yardstick showing, for example, how much risk is acceptable, and the organization sets them before evaluation begins. The result of the evaluation becomes the input to the next step, risk treatment.
AnalogyIt is like comparing test scores with the passing mark to decide which subjects need extra lessons and which to start with.
How to rememberEvaluation shares its root with value. Link it to the step where you hold each risk up to a yardstick and decide what it is worth.
Exam points
ExamRisk evaluation (リスク評価) compares the risk sizes calculated in analysis with predetermined criteria and decides how serious each risk is and in what priority to treat it.
ExamCreating the criteria used for the judgment is not part of risk evaluation itself. The criteria are prepared before evaluation starts.
Mix-upEstimating the size is as far as risk analysis (リスク分析) goes; checking that size against criteria to decide whether treatment is needed is risk evaluation.