Chapter 23 — Security governance, risk and compliance: methods I
Lesson map
Lesson 23 published. Map, example, EX067.
flowchart TD
N0["Learning outcomes"]
N1["23.1 Matrix scoring"]
N2["23.2 Expected loss"]
N3["Lab — Matrix scores versus expected loss"]
N4["23.3 When they disagree"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX067"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["23.1 Matrix scoring"]
N2["23.2 Expected loss"]
N3["Lab — Matrix scores versus expected loss"]
N4["23.3 When they disagree"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX067"]
[Learning outcomes]
|
v
[23.1 Matrix scoring]
|
v
[23.2 Expected loss]
|
v
[Lab — Matrix scores versus expected loss]
|
v
[23.3 When they disagree]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX067]
Learning outcomes
You will (1) score risks on a 5x5 matrix; (2) compare matrix scores with expected loss; (3) understand when the two disagree.
23.1 Matrix scoring
Elmfield scores risks on a five-by-five matrix: likelihood and impact each from one to five, multiplied for a score. Sofia scores five risks with managers. Misdirected tenant data scores twelve, the lost laptop twelve, ransomware ten, contractor misuse nine and payment page outage six. The matrix is quick and familiar, which is why many organisations use it. Sofia also asks managers for an annual probability and a typical loss for each risk, to compare methods. Asking for a probability and a loss alongside each score is what makes the comparison in the next section possible.
23.2 Expected loss
The lab computes expected loss as probability times loss. Ransomware, with a one-in-ten chance and a loss of two hundred and fifty thousand, has the highest expected loss at twenty-five thousand. Misdirected data follows at twelve thousand and the lost laptop at ten thousand. The matrix ranks misdirected data first, tied with the laptop, while expected loss ranks ransomware first. The disagreement arises because the matrix compresses a very large impact into a score of five. Because the matrix caps impact at five, ransomware's loss of two hundred and fifty thousand cannot be shown as many times larger than the smaller losses.
Lab — Matrix scores versus expected loss
"""5x5 scores vs expected loss (thousands) for five Elmfield risks."""
risks = [("tenant data misdirected", 4, 3, 0.8, 15), ("ransomware", 2, 5, 0.1, 250),
("lost laptop", 3, 4, 0.5, 20), ("payment page outage", 3, 2, 0.6, 8), ("contractor misuse", 3, 3, 0.2, 40)]
for n, l, i, p, loss in risks: print(f"{n}: score {l*i}, expected loss {p*loss:.1f}k")
print("top by score:", max(risks, key=lambda r: r[1]*r[2])[0]); print("top by expected loss:", max(risks, key=lambda r: r[3]*r[4])[0])
Run with python3 lab_score.py. Verified output:
tenant data misdirected: score 12, expected loss 12.0k
ransomware: score 10, expected loss 25.0k
lost laptop: score 12, expected loss 10.0k
payment page outage: score 6, expected loss 4.8k
contractor misuse: score 9, expected loss 8.0k
top by score: tenant data misdirected
top by expected loss: ransomware
23.3 When they disagree
Sofia reads Cox (2008), who shows that risk matrices can assign higher ratings to quantitatively smaller risks and can produce ties between very different risks. Her lab illustrates both problems. She does not conclude that matrices are useless: they help start conversations and are easy for non-specialists. She recommends that Elmfield keep the matrix for initial screening but add rough expected loss estimates for its top risks, so that rare but severe risks like ransomware are not underestimated. Expected loss estimates for only the top five risks keep the extra work small for a team of Elmfield's size.
Worked example
Sofia finds the matrix ranks misdirected data first while expected loss ranks ransomware first, and recommends combining both.
Synthetic case. Scores and estimates are synthetic; Cox (2008) is real.
Errors and limits
Expected loss needs uncertain inputs. Matrices compress severity.
Exercises
- EX067 — Matrix top. Which risk tops the matrix ranking? Rubric: 3 = misdirected tenant data, tied with the laptop at 12;; 2 = tie;; 1 = ransomware;; 0 = none.
- EX068 — Expected-loss top. Which risk tops by expected loss? Rubric: 3 = ransomware at 25k;; 2 = ransomware;; 1 = laptop;; 0 = none.
- EX069 — Disagreement cause. Why do the methods disagree on ransomware? Rubric: 3 = the matrix compresses very large impacts into a score of five;; 2 = compression;; 1 = vague;; 0 = none.
Synthesis
Matrices aid screening, but expected loss reveals severe risks they understate.
Continue studying — chapter 23 of 40
← Chapter 22 (draft) · Course chapter index · Chapter 24 (draft) →