IT Risk Fundamentals

Vulnerability analysis collects evidence about specific weaknesses and exposures, then uses those findings to infer potential security risks. This is an inductive approach because it moves from individual observations to broader conclusions.

The Delphi technique systematically elicits expert opinions on possible risks and uses structured, often iterative feedback to validate and prioritize them. Monte Carlo analysis models uncertainty quantitatively, whereas brainstorming generates ideas in a group without the same structured expert-ranking process.

Historical information about incidents, their frequency, and resulting organizational losses provides evidence for estimating risk likelihood and impact. These estimates are central to I&T-related risk analysis.

Annual loss expectancy (ALE) applies quantitative monetary values to expected loss frequency and impact, providing an objective, consistently interpretable basis for risk analysis. Delphi and brainstorming rely on expert judgment, so they retain greater subjectivity.

Vulnerability severity is a direct contributor to risk assessment and prioritization because it indicates the seriousness of a weakness and supports risk-response decisions. The cost of controls is considered when choosing a treatment, whereas risk-management-process maturity is an organizational capability measure rather than a risk-ranking input.