Quantitative Risk Assessment Flashcards

A financial institution uses Value at Risk (VaR) for cyber risk. A 99% VaR of $5 million means:

Answer: There is a 1% chance losses will exceed $5 million in a given period

VaR at 99% confidence means there is a 1% probability that losses will exceed the stated amount in the defined period.

When building a quantitative risk model, what is the primary purpose of using probability distributions (e.g., PERT, lognormal) for loss estimates?

Answer: To capture the range and likelihood of different loss scenarios

Probability distributions capture the inherent uncertainty in loss estimates by modeling the full range of plausible outcomes.

An organization experiences data breaches at an average rate of 0.5 times per year. Using the Poisson distribution, what is the probability of exactly zero breaches in a given year?

Answer: approximately 61%

P(0) = e^(-0.5) ≈ 0.6065, or about 61%, using the Poisson formula with λ=0.5.

In the FAIR (Factor Analysis of Information Risk) model, what are the two primary components that combine to determine risk?

Answer: Loss event frequency and loss magnitude

FAIR defines risk as a function of Loss Event Frequency (how often) and Loss Magnitude (how much).

A cyber risk analyst is told to use a 'minimum, most likely, maximum' approach for loss estimates. Which distribution does this describe?

Answer: PERT (Program Evaluation and Review Technique) distribution

PERT distribution uses minimum, most likely, and maximum values to model uncertain estimates with emphasis on the most likely value.

What is the key difference between Tail Risk and average expected loss in cyber risk quantification?

Answer: Tail risk focuses on rare, high-severity loss events beyond a confidence threshold

Tail risk captures catastrophic, low-probability events in the extreme end of a loss distribution beyond the VaR threshold.

Which metric is most useful for comparing the cost-effectiveness of two different security controls in a quantitative risk assessment?

Answer: Return on Security Investment (ROSI)

ROSI allows direct comparison of controls by measuring the net risk reduction relative to each control's cost.