OpenCyber Academy
Professional · Chapter 3 · English
Course code: OCA-025Chapter 03: OCA-025-C003

Chapter 3 — Risk in plain terms

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 03 published. Map, example, EX011.

flowchart TD
  N0["Learning outcomes"]
  N1["3.1 What risk means"]
  N2["3.2 Building the register"]
  N3["Lab — Ranking a synthetic risk register by likelihoo"]
  N4["3.3 Reading the ranking"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX011"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["3.1 What risk means"]
  N2["3.2 Building the register"]
  N3["Lab — Ranking a synthetic risk register by likelihoo"]
  N4["3.3 Reading the ranking"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX011"]

[Learning outcomes]
    |
    v
[3.1 What risk means]
    |
    v
[3.2 Building the register]
    |
    v
[Lab — Ranking a synthetic risk register by likelihoo]
    |
    v
[3.3 Reading the ranking]
    |
    v
[Worked example] --> [Exercise EX011]

Learning outcomes

You will (1) describe risk as likelihood and impact; (2) build a small risk register; (3) rank risks with a simple script.

3.1 What risk means

Ms. Ashby defines a risk as something that could go wrong, described by how likely it is and how much harm it would cause. NIST SP 800-30 Revision 1, the guide to conducting risk assessments, uses the same two ideas, though in more detail. She asks the group to write each risk as a short sentence naming the cause and the result, such as phishing leads to mailbox takeover. Vague entries like cyber attack cannot be acted on, because nobody knows which control would help or who should own the work.

3.2 Building the register

Daniel lists eight risks for Corbridge after talking with partners and the support company. He scores each from one to five for likelihood and impact, using simple descriptions: a likelihood of four means it has happened to similar firms several times recently; an impact of five means client harm, regulatory reporting and lost clients. Ms. Ashby reminds him that the scores are judgements, not measurements, and that their value lies in forcing a conversation about which risks matter most. He records who gave each score and why.

Lab — Ranking a synthetic risk register by likelihood times impact

"""Score a synthetic risk register by likelihood x impact and rank it (stdlib only)."""
risks = [
    ("R1 phishing leads to mailbox takeover", 4, 4),
    ("R2 laptop lost with client files", 3, 4),
    ("R3 ransomware on file server", 2, 5),
    ("R4 payment diversion by fake invoice", 3, 5),
    ("R5 leaver keeps cloud access", 3, 3),
    ("R6 backup fails silently", 2, 4),
    ("R7 website defaced", 2, 2),
    ("R8 tax software vendor breach", 1, 4),
]
scored = sorted(((l * i, name, l, i) for name, l, i in risks), reverse=True)
for s, name, l, i in scored:
    band = "high" if s >= 15 else "medium" if s >= 8 else "low"
    print(f"{s:>2} {band:<6} {name} (L{l} x I{i})")
print("high:", sum(1 for s, *_ in scored if s >= 15), "medium:", sum(1 for s, *_ in scored if 8 <= s < 15), "low:", sum(1 for s, *_ in scored if s < 8))

Run with python3 lab_risk.py. Verified output:

16 high   R1 phishing leads to mailbox takeover (L4 x I4)
15 high   R4 payment diversion by fake invoice (L3 x I5)
12 medium R2 laptop lost with client files (L3 x I4)
10 medium R3 ransomware on file server (L2 x I5)
 9 medium R5 leaver keeps cloud access (L3 x I3)
 8 medium R6 backup fails silently (L2 x I4)
 4 low    R8 tax software vendor breach (L1 x I4)
 4 low    R7 website defaced (L2 x I2)
high: 2 medium: 4 low: 2

3.3 Reading the ranking

The script multiplies likelihood by impact and sorts the register. Two risks score fifteen or more and are marked high: phishing leading to mailbox takeover at sixteen, and payment diversion by a fake invoice at fifteen. Four are medium, from lost laptops at twelve down to silent backup failure at eight. Two are low at four each: a breach at the tax software vendor and website defacement. Daniel notices that both high risks start with an email, which tells him where to focus first and gives him a simple message for the partners.

3.4 Limits of scoring

Ms. Ashby warns against treating the numbers as precise. A vendor breach scored low because Daniel judged it unlikely, but its impact could reach every client at once. She suggests keeping a short note beside any low-scoring risk with a severe worst case, so leadership sees it rather than having it hidden at the bottom of a list. Daniel adds such a note to the vendor risk and plans to ask the vendor about its own security in the supplier chapter. He also sets a date to review all scores in three months.

Worked example

Daniel scores eight synthetic risks; the script ranks phishing takeover (16) and invoice fraud (15) as high, four medium and two low, and he flags the vendor risk's severe worst case.

Synthetic case. Risks and scores are synthetic.

Errors and limits

Treating judgement-based scores as precise measurements hides uncertainty from decision makers.

Exercises

Worked answers

EX011. Phishing leading to mailbox takeover, scored 16.

EX012. Two: mailbox takeover and invoice fraud.

EX013. Both start with an email.

EX014. Its score is low but its worst case could reach every client.

EX015. As a short sentence naming the cause and the result.