Chapter 24 — Security architecture and engineering: methods I
Lesson map
Lesson 24 published. Map, example, EX070.
flowchart TD
N0["Learning outcomes"]
N1["24.1 Qualitative and quantitative"]
N2["24.2 Running an assessment"]
N3["24.3 Risk decisions and owners"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX070"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["24.1 Qualitative and quantitative"]
N2["24.2 Running an assessment"]
N3["24.3 Risk decisions and owners"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX070"]
[Learning outcomes]
|
v
[24.1 Qualitative and quantitative]
|
v
[24.2 Running an assessment]
|
v
[24.3 Risk decisions and owners]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX070]
Learning outcomes
You will (1) compare qualitative and quantitative risk methods; (2) run a risk assessment following SP 800-30 Rev. 1; (3) document risk decisions with owners.
24.1 Qualitative and quantitative
Risk can be rated qualitatively, with scales like low, medium and high, or quantitatively, with estimated frequencies and losses. Qualitative methods are fast and help discussion but hide large differences within a category. Quantitative methods force explicit assumptions but can create false precision when inputs are guesses. Sofia uses both: a qualitative pass to rank many risks, then quantitative estimates with ranges for the top few, where decisions involve real money. She records the assumptions behind each number so that readers can challenge them rather than accept a figure at face value.
24.2 Running an assessment
NIST SP 800-30 Rev. 1 describes preparing the assessment, conducting it by identifying threat sources, events, vulnerabilities, likelihood and impact, communicating results and maintaining the assessment. Sofia follows these steps for the back office. She defines scope and assumptions, identifies threat sources from the STRIDE session and the context statement, rates likelihood and impact on agreed scales and records each risk. The method's value is consistency: another assessor using the same scales and information should reach similar ratings, which makes results comparable over time and across systems.
24.3 Risk decisions and owners
Each risk needs a decision: mitigate, transfer, avoid or accept. Sofia prepares a risk register where each entry has an owner with authority to decide. The finance director accepts a residual risk of up to one hour of stolen-card use, documented in chapter 5. The head of operations owns the risk of validator certificate misuse and approves a revocation project. Daniel stresses that engineers recommend but business owners decide, and that accepted risks must be reviewed regularly, because acceptance made under one context may be wrong after the context changes.
Worked example
Sofia ranks twenty back-office risks qualitatively, estimates ranges for the top three, follows SP 800-30 Rev. 1 steps and assigns owners and decisions in a register.
Synthetic case. Risks, ratings and owners are synthetic; SP 800-30 Rev. 1 is real.
Errors and limits
Risk scales mean different things to different people unless anchored with examples. Quantitative ranges remain uncertain.
Exercises
- EX070 — Qualitative weakness. What is a weakness of qualitative risk scales? Rubric: 3 = they hide large differences within one category;; 2 = hides differences;; 1 = vague;; 0 = none.
- EX071 — SP 800-30 steps. Name the four main steps of SP 800-30 Rev. 1. Rubric: 3 = prepare, conduct, communicate, maintain;; 2 = three;; 1 = one;; 0 = none.
- EX072 — Who decides. Who decides whether to accept a risk? Rubric: 3 = the business owner with authority, not the engineer;; 2 = owner;; 1 = engineer;; 0 = none.
Synthesis
Sound risk methods combine quick ranking with explicit estimates and put decisions in the hands of accountable owners.
Continue studying — chapter 24 of 50
← Chapter 23 (draft) · Course chapter index · Chapter 25 (draft) →