Control Analysis
This phase includes assessment of controls already been implemented or planned, probability that
they can be broken, assessment of potential loss despite such controls existing. Controls are also
classified as non-technical controls also called management controls and technical controls –
software, hardware controls. The output of this step is current or planned controls used for the IT
system to measure the likelihood of vulnerability being exercised and reduce the impact of loss.
37.1 Likelihood Determination
xThis phase determines that a potential vulnerability could be exercised by a given
threat-source. Following table will help us to define and understand the likelihood
definitions.
The input to this phase is
xThreat source motivation
xThreat capacity
xNature of vulnerability
xCurrent Controls
The output to this phase is a likelihood rating to be used further in the risk assessment process.
37.2 Impact Analysis
This phase determines the adverse impact resulting from a successful threat exercise of
vulnerability. Following information is required before conducting an impact analysis.
1. System mission e.g. the process performed by IT system.
2. System and data criticality e.g. the system’s value or importance to an organization
3. System and data sensitivity
The information can be obtained from existing organizational documentation.
The threat source lacks motivation
or capability or controls are in
place to prevent or at least
significantly impede the
vulnerability from being exercised.
Low
The threat source is motivated and
capable but controls are in place
that may impede the successful
exercise of the vulnerability.
Medium
The threat source is highly
motivated and sufficiently capable
and controls to prevent the
vulnerability from being exercised
are ineffective
High
Likelihood DefinitionLikelihood level
The threat source lacks motivation
or capability or controls are in
place to prevent or at least
significantly impede the
vulnerability from being exercised.
Low
The threat source is motivated and
capable but controls are in place
that may impede the successful
exercise of the vulnerability.
Medium
The threat source is highly
motivated and sufficiently capable
and controls to prevent the
vulnerability from being exercised
are ineffective
High
Likelihood DefinitionLikelihood level
docsity.com
