Pebellslearn by building
0%
RoadmapsMatrixCoursesSandboxSign in
Core Security Principles  ›  Lesson

Understanding Risk

Understand the Definition of Risk 15 minRisk combines how likely a threat is to use a vulnerability against an asset with how much harm that would cause, and it can be reduced, accepted, transferred or avoided.

Understanding Risk

Priya has a small budget and a long list of worries: hackers, floods, lost laptops, a staff member clicking a bad link. She cannot fix everything at once. Risk is the idea that turns a list of fears into an ordered to-do list.

The rule

Risk is how likely something is times how much it would hurt.

The pieces:

  • Asset — something worth protecting: customer data, the website, the till, the shop's reputation.
  • Threat — something that could cause harm: a criminal, a careless mistake, a fire.
  • Vulnerability — a weakness a threat could use: an unpatched laptop, a reused password, no backups.
  • Risk — the chance that a threat uses a vulnerability to hurt an asset, weighed by how bad that would be.

A simple way to rate it: score likelihood and impact from 1 (low) to 3 (high) and multiply. A 9 comes first; a 1 can wait.

Once a risk is understood, there are four ways to respond:

  • Reduce it — add a control, such as MFA or backups.
  • Accept it — it is small or too costly to fix, and you record that decision.
  • Transfer it — share the cost with someone else, such as insurance or a payment provider handling card data.
  • Avoid it — stop doing the risky thing altogether.

The shortcut

For each worry, fill in one line: "[Threat] uses [vulnerability] to hurt [asset]: likelihood × impact = score." Then sort by score.

Priya's top three worriesStep 1 of 4

  1. Phishing email steals the email password

    Likelihood 3, impact 3: score 9. Reduce it with MFA and staff training.

The trap is spending the budget on the scariest-sounding threat rather than the highest-scoring one. Movie-style hacking is less likely than a stolen password.

Drills

Answer fast — trust the rule.

quick drill

The shop's laptops have not been updated for a year. In risk terms, what is that?

quick drill

Likelihood 3 and impact 2 on a 1 to 3 scale. What is the risk score?

quick drill

The shop lets its card payment provider store all card numbers instead of keeping them itself. Which response is this?

quick drill

Which should Priya fix first?

Remember

  • Risk is how likely something is times how much it would hurt.
  • Write "threat uses vulnerability to hurt asset", score it, sort it.
  • Respond by reducing, accepting, transferring or avoiding. Trap: chasing the scariest story, not the highest score.

Practice — level up

0/1 solved

Write your answer, then compare it with a rubric and a model answer.

ExplainTurn fears into a to-do list

Pick two risks for Hollow Oak Books that are not in the lesson. For each, name the threat, vulnerability and asset, give a likelihood and impact score, and choose a response (reduce, accept, transfer or avoid). Say which you would handle first and why.