Chapter 3 — Risk assessment for a clinic network

Lesson map

Lesson 03 published. Map, example, EX011.

flowchart TD
  N0["Learning outcomes"]
  N1["3.1 Method"]
  N2["3.2 Consistent ratings"]
  N3["3.3 Results"]
  N4["3.4 Treatment"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX011"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["3.1 Method"]
  N2["3.2 Consistent ratings"]
  N3["3.3 Results"]
  N4["3.4 Treatment"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX011"]

[Learning outcomes]
    |
    v
[3.1 Method]
    |
    v
[3.2 Consistent ratings]
    |
    v
[3.3 Results]
    |
    v
[3.4 Treatment]
    |
    v
[Worked example] --> [Exercise EX011]

Learning outcomes

You will (1) conduct a structured risk assessment; (2) rate likelihood and impact consistently; (3) select treatments aligned with appetite.

3.1 Method

Elena follows the approach in NIST SP 800-30 Revision 1: identify threat sources and events, vulnerabilities and predisposing conditions, then judge likelihood and impact. She runs workshops with clinic managers, the clinical lead and finance. The workshops identify ransomware, phishing leading to account compromise, lost or stolen tablets, supplier failure and staff misuse of patient records as the main threats. Dr. Qureshi advises involving people who run the work, because they know where processes really break. Each workshop lasts two hours and produces a list of threats with examples.

3.2 Consistent ratings

Ratings vary between people. Elena defines five-point scales with examples: impact five means a clinic cannot treat patients for over a day or many patient records are exposed; likelihood five means expected within a year. She asks two colleagues to rate ten risks independently and compares results. Where they differ by more than one point, they discuss and agree. Dr. Qureshi notes that calibration exercises make ratings more consistent and defensible. Three of the ten risks needed discussion, and the agreed ratings are recorded with the reasons.

3.3 Results

Ransomware and phishing-led compromise rate highest, followed by patching delays in clinics without IT staff and weak recovery testing. Staff misuse of patient records rates moderate likelihood and high impact. Elena records each risk with an owner, current controls and planned treatment. She notes that patch delays and weak recovery both make ransomware more damaging, so treating them reduces several risks at once. She presents the register to the security committee as a one-page heat map with the top five risks listed beneath it, each with its owner and the next planned action.

3.4 Treatment

Elena selects treatments aligned with appetite. For ransomware, she plans faster patching, immutable backups and tested recovery. For phishing, she plans multi-factor authentication and mail filtering improvements. For misuse, she plans access reviews and alerts on unusual record viewing. Cyber insurance transfers some financial loss. The board approves the plan, accepting moderate residual risk for administrative systems. Dr. Qureshi notes that recording accepted risks protects everyone later. Elena records the board's decision and the accepted residual risks in the minutes, with a review date set for the following year.

Worked example

Elena runs workshops following SP 800-30 Revision 1, calibrates five-point scales, ranks ransomware and phishing highest and selects treatments approved by the board.

Synthetic case. Assessments are synthetic.

Errors and limits

Uncalibrated ratings vary widely between assessors.

Exercises

• EX011 — Threat example. Name one main threat identified.
  Show marking criteria

  Rubric: 3 = ransomware;; 2 = one;; 1 = vague;; 0 = none.
• EX012 — Calibration rule. When do raters discuss differences?
  Show marking criteria

  Rubric: 3 = when they differ by more than one point;; 2 = partly correct;; 1 = vague;; 0 = none.
• EX013 — Linked risks. Which two risks worsen ransomware damage?
  Show marking criteria

  Rubric: 3 = patch delays and weak recovery;; 2 = partly correct;; 1 = vague;; 0 = none.
• EX014 — Misuse treatment. How is staff misuse treated?
  Show marking criteria

  Rubric: 3 = access reviews and alerts on unusual viewing;; 2 = partly correct;; 1 = vague;; 0 = none.
• EX015 — Transfer method. What transfers some financial loss?
  Show marking criteria

  Rubric: 3 = cyber insurance;; 2 = partly correct;; 1 = other;; 0 = none.