What is a risk scenario and how to define it

COBIT 5 risk scenarios is still one of my favorite ways to identify security risks. Using
COBIT risk scenario examples as a reference and having the below components identified
helps to define a meaningful and complete risk scenario, and that will help with identifying
relevant controls.

Who is the Threat Actor? Internal staff, 3rd party, competitor, etc.

What is the Threat Type? Malicious, error, accident, etc.

What is the Threat Event? Disclosure, interruption, theft, misuse, etc.

Which Assets is at risk? People, process, systems, applications, network, etc.

What Vulnerabilities are on that asset that can be exploited by the threat?

What is the expected event Time? Occurrence, duration, frequency, etc.

I see quite often that people get vulnerabilities or threats confused with risks. Risk is only
valid when there is both vulnerability and threat are present for a particular asset. For
example, “a php vulnerability on a web application” is not the risk, neither something like a
“sensitive data breach”. Instead, an example of a risk scenario can be:

“Cyber criminals are able to use the php vulnerability on the external facing ecommerce web
application to download large amount of personal credit card data, once in a year.”

There is also a very good example on FAIR Institute website about the bald tire risk scenario
(https://www.fairinstitute.org/white-papers-bald-tire). That explains what we mentioned
above in more details. Picture in your mind a bald car tire. Imagine that it’s so bald you can
hardly tell that it ever had tread. How much risk is there?

Next, imagine that the bald tire is tied to a rope hanging from a tree branch. How much risk is
there?

Next, imagine that the rope is frayed about halfway through, just below where it’s tied to the
tree branch. How much risk is there?

Finally, imagine that the tire swing is suspended over an 80-foot cliff – with sharp rocks
below. How much risk is there?
Now, identify the following components within the scenario. What were the threats; the
vulnerabilities; the risks?

Risk is Likelihood Multiplied by Impact (impact = threat times vulnerabilities). The reason
we maintain this as operation of multiplication rather than addition is that a massive impact
with zero likelihood with have a result of zero risk. If this was a matter of addition risk that
could never happen would appear in our risk analysis.