Risk analysis

Skip to content

This is a machine-translated text that may contain errors!

Knowing that threats exist is good, but it helps little if you don’t know which threats are most relevant to your system. A risk analysis helps you prioritize: what should you protect, what can go wrong, and what should you do about it?

What is a risk analysis?

A risk analysis is a systematic review where you:

  1. Find out what can go wrong
  2. Assess how likely it is
  3. Assess how serious the consequence is
  4. Propose measures to reduce the risk

You don’t need to be a security expert to do this. It’s about thinking systematically.

Step by Step

1. Value Assessment: What do we have?

Before you can protect something, you need to know what you have. List the most important assets in the system:

Asset Example Why important?
Data User data, project files Cannot be recreated
Services Web server, email, file storage People depend on them
Hardware Servers, network equipment Costs money and time to replace
Reputation The trust users have in the system Difficult to rebuild

2. Risk Identification: What can go wrong?

Think through what can threaten your values:

Risk Description
Ransomware Files are encrypted and ransom is demanded
Power outage Servers and networks go down
Disk failure Data is lost
Phishing Someone gives away passwords
Misconfiguration A change that takes down a service
Natural disaster Fire, water damage, thunderstorm

3. Assess Probability and Consequence

For each risk, you assess two things on a scale (e.g. 1-5):

  • Probability: How likely is this to happen?
  • Consequence: How serious is it if it happens?

Risk Value = Probability × Consequence

Risk Probability (1-5) Consequence (1-5) Risk Value
Disk Failure 3 4 12
Ransomware 2 5 10
Phishing 4 3 12
Power Outage 2 3 6
Misconfiguration 3 3 9

The higher the risk value, the more priority you should give to the measures.

Risikomatrise

A risk matrix visually displays this with colors:

  • 🟢 Low (1-6): Acceptable risk, but keep an eye on it
  • 🟡 Medium (7-14): Should have measures in place
  • 🔴 High (15-25): Requires immediate action

4. Propose Measures

For each risk with high or medium value, propose measures:

Risk Measure
Disk failure Backup (3-2-1 rule), RAID on servers
Ransomware Updates, offline backup, training
Phishing Awareness, MFA, email filtering
Misconfiguration Documentation, change log, snapshot before change

5. Document and Follow Up

The risk analysis is not a one-time exercise. Write it down, share it with the team, and review it regularly (e.g., every six months or after an incident).

Medium Task 1 - Perform a Mini-Risk Analysis

Choose a system you are familiar with (e.g., your own PC, a VM you have set up, or the school network) and go through the steps:

  1. List 3-5 values (what is important?)
  2. Identify 3-5 risks (what can go wrong?)
  3. Give each item a probability and consequence (1-5)
  4. Suggest measures for those with the highest risk value

Use a spreadsheet or a simple table in Markdown.

Summary

  • A risk analysis helps you prioritize security measures
  • The steps are: value assessment, risk identification, assessment of probability/consequence, measures and documentation
  • Risk value = probability × consequence
  • Risk analysis is not a one-time exercise, it should be updated regularly

You can download a risk assessment template from Datatilsynet.