Like any discussion about a technical computational method like risk analysis, we need to have definitions with which to work. So let's begin with those. First, what is risk? Well, we all have an idea of what risk is but in this particular context, we need to understand it so that we know what we're computing, and what the result will mean.

First, risk is the probability of harm occurring. That is to say it is a probability. It is also the level of financial impact. Inherent risk is the total risk that we have before any controls or any newer controls are introduced. And the residual risk is that risk that remains after all cost-effective reductions are performed.

Risk management is the process of performing all of these things. The decision-making, the computation and so on with respect to drive decisions about how the risk will be dealt with. Risk assessment itself is the analysis of an environment, which we would call scope for this problem, to determine the presence and character of threats, vulnerabilities, impacts, possible mitigation options and potential outcomes of realized events upon assets, operations and people.

Risk assessment is typically done in a hybrid of two forms. One is qualitative, which is in its performance, a subjective process that uses subject matter expert and historical events and their outcomes to determine whether we think the risk is something that we can tolerate or not. We have the quantitative, which is more of an objective process that relies on models or impacts and relies very heavily on numerical values, such as probabilities and dollar values.

The fact is whatever process you use, it will be a hybrid of these two: Qualitative to envision a scenario of outage, and quantitative which will put numbers and probabilities to all these. Then we have mitigation, which is an action that reduces the probability or the consequence of a threat.

Now, mitigation is an active process to oppose the threat and the damage that it can cause. We have, of course, the asset, and this is a resource or the data itself required for organization operations. Assets must have a value in order to judge what sort of mitigation strategy we're going to use commensurate with that value. So this method of determining or assigning value is how we make that judgment and typically, the asset valuation method should be something either identical to or very similar to the sort of asset valuation methods the business context uses under normal operations. 

We have threats and the threat agent. The threat is an event that produces harm and the threat agent is the causative factor. For example, a flood is a threat, the damage that it can cause by the flood, and a hurricane is what causes the flood, and so here we have the threat, the flood, and the threat agent or hurricane that causes it. We have vulnerabilities, and this is any characteristic of an asset through which harm can be caused.

A vulnerability can also exist within a control structure if that control is weak or out of date. An exposure is an exploitable type of vulnerability or in the case of financial operations, exposure is the degree to which you're exposed to a financial loss. We have safeguards and controls, which are considered to be proactive, things that we put in place to prevent something from happening in the first place or things that we may design and build in for that same purpose.

Then we have countermeasures. These are considered to be reactive measures or actions that respond to oppose risks and threats as they occur. And an attack. An attempt to perform undesired or unauthorized actions that will result in harmful consequences.

Now, not everything is considered an attack. Some things are purely events, some things are purely failures. An attack tends to indicate an aggressive, hostile action taken against an asset or a target. That is not always the case. But this term is used in the generic sense to indicate that something undesired or unauthorized is taking place that will result in something harmful.