CompTIA Security+ Preparation · lesson 33 of 45 · 25 min
Risk Management Fundamentals
Risk is the potential for loss or harm resulting from a threat exploiting a vulnerability. Risk management is the process of identifying, assessing, and responding to risks to reduce them to an acceptable level.
Risk cannot be eliminated — only managed. The goal is to reduce risk to a level the organization can accept given its risk appetite and available resources.
Risk formula
Risk = Threat × Vulnerability × ImpactOr more simply: Risk = Likelihood × Impact
Risk Response Strategies
Risk Assessment Types
Quantitative Risk Calculations
The Security+ exam tests these quantitative risk formulas:
Worked example
A server is worth $100,000 (AV). A fire would destroy 40% of it (EF = 0.4). SLE = $100,000 × 0.4 = $40,000. Fires occur once every 5 years (ARO = 0.2). ALE = $40,000 × 0.2 = $8,000/year. If a sprinkler system costs $5,000/year, it is worth installing.
Flashcard Drill
Risk avoidance Eliminating the activity that creates the risk entirely. Risk transfer Shifting financial impact to a third party — cyber insurance, outsourcing. Risk mitigation Implementing controls to reduce likelihood or impact of a risk. Risk acceptance Acknowledging a risk and choosing not to act — documented decision. SLE Single Loss Expectancy = Asset Value × Exposure Factor — cost of one incident. ALE Annual Loss Expectancy = SLE × ARO — expected annual cost of a risk. ARO Annual Rate of Occurrence — how many times per year an incident is expected. Qualitative risk assessment Uses subjective ratings (High/Medium/Low) — produces a risk heat map. Quantitative risk assessment Uses financial calculations (SLE, ALE) to express risk in dollar terms. Risk appetite The amount of risk an organization is willing to accept in pursuit of its objectives.
Scenario Practice
Risk Response Decision
This is risk avoidance — they stopped using the server. This is risk transfer — they bought insurance. This is risk mitigation — they reduced the risk with compensating controls while planning full remediation. This is risk acceptance — they did nothing. 2 Adding segmentation and monitoring reduces (mitigates) the risk while the long-term fix is planned. They did not eliminate the risk (avoid), transfer it, or simply accept it without action.
Knowledge Check
Risk Management — 10 Questions
A company purchases cyber insurance to cover losses from a data breach. This is which risk response strategy?
- Avoid
- Transfer
- Mitigate
- Accept
Answer: Transfer
Cyber insurance transfers the financial impact of a breach to the insurer.
SLE is calculated as:
- AV + EF
- AV × EF
- ALE / ARO
- ARO × AV
- Answer: AV × EF
SLE (Single Loss Expectancy) = Asset Value × Exposure Factor.
ALE = SLE × _____.
Answer: ARO
Annual Loss Expectancy = Single Loss Expectancy × Annual Rate of Occurrence.
A server worth $500,000 has an exposure factor of 20%. What is the SLE?
- $20,000
- $100,000
- $500,000
- $2,500
Answer: $100,000
SLE = $500,000 × 0.20 = $100,000.
Which risk assessment type uses financial calculations to express risk in dollar amounts?
- Qualitative
- Quantitative
- Semi-quantitative
- Subjective
Answer: Quantitative
Quantitative risk assessment uses formulas (SLE, ALE, ARO) to calculate risk in financial terms.
Risk acceptance means the organization has implemented controls to reduce the risk.
- True
- False
Answer: False
Risk acceptance means acknowledging the risk and choosing not to act — no controls are implemented.
A company decides to stop collecting Social Security Numbers because the liability outweighs the benefit. This is:
- Risk transfer
- Risk mitigation
- Risk avoidance
- Risk acceptance
- Answer: Risk avoidance
Eliminating the activity that creates the risk is risk avoidance.
A qualitative risk assessment produces which output?
- Dollar amount of annual loss
- Risk heat map with High/Medium/Low ratings
- SLE and ALE calculations
- CVE scores
Answer: Risk heat map with High/Medium/Low ratings
Qualitative assessments use subjective ratings and produce risk matrices or heat maps.
Risk appetite describes how much risk an organization is willing to accept in pursuit of its objectives.
- True
- False
Answer: True
Risk appetite is the organization’s stated willingness to accept risk — it drives risk response decisions.
If SLE = $50,000 and ARO = 0.5, what is the ALE?
- $100,000
- $25,000
- $50,000
- $10,000
Answer: $25,000
ALE = SLE × ARO = $50,000 × 0.5 = $25,000.
Try it: Order of volatility
Previous lesson: Incident response lifecycle: preparation, detection, containment, eradication, recovery
Back to CompTIA Security+ Preparation
Next lesson: Log analysis and SIEM: correlation rules, dashboards, alerting, threat hunting