Risk from human-enabled causes
The model described here quantifies risk related to administrative controls: the processes and practices carried out by people, such as managing access, training users and responding to incidents.
Surveys of breach reports across a decade attribute between 85 and 95% of breaches to human error or inadequate administrative controls.
Three elements
| Element | What it is | How it is rated |
|---|---|---|
| Vulnerability | A weakness or gap in a security control that a threat could exploit | A priority, reflecting how important the control is, and a severity |
| Threat | An actor, technique or campaign that seeks to exploit vulnerabilities | A prominence, reflecting how often it is currently seen, and a severity |
| Impact | A consequence the organization wants to avoid | A severity, and a priority assigned by the team |
Every severity is rated three times: for confidentiality, for integrity and for availability.
Who supplies what
The team supplies the impact priorities, because only it knows which consequences matter most for its resource. A healthcare organization may put the confidentiality of patient data first, and a financial institution the integrity of its transactions.
Everything else comes from the model, which is curated centrally. Vulnerabilities are mapped to the threats that can exploit them. This is how people can work in qualitative terms while the result is quantitative.
From three elements to one rank
- For each element, the priority or prominence is combined with the severity in each of the three dimensions, and the result is normalized to a value between 0 and 1.
- For each dimension, the three normalized values are multiplied together. The dimension with the highest product is the one where this risk matters most.
- The three values for that dimension are combined as a weighted sum. The result is the maximum risk rank: how serious the risk would be if the vulnerability were completely unmitigated.
What the team has in place
The maximum rank is then reduced by what the team has implemented. The team's control inventory gives a protection factor for the control concerned, and the remainder is exposure.
exposure = 1 - protection factor
risk rank = maximum risk rank * exposure
A vulnerability with a high maximum rank that is well mitigated ends up with a low risk rank. Working at the Objective Level explains where the protection factor comes from.
Keeping it current
The model has to follow the threat landscape. It is curated from threat intelligence feeds, sector security reports and the insight of researchers. Risk ranks are recalculated when the model changes or when a team updates its inventory.
Defining the Operating Model describes where this model sits in a program.