Start course

This course is one of four courses covering Domain 1 of the CSSLP. This course explores the topic of risk management.

Learning Objectives

The objectives of this course are to provide you with an understanding of:

  • Risk management problem space and management flow

  • Definitions, terminology, and types of risks

  • Control Categories and Functions

  • Cost-Benefit Assessment

  • General Risk Assessment Model

  • Overall Control Objectives

Intended Audience

This course is designed for those looking to take the Certified Secure Software Lifecycle Professional (CSSLP)​ certification.


Any experience relating to information security would be advantageous, but not essential.  All topics discussed are thoroughly explained and presented in a way allowing the information to be absorbed by everyone, regardless of experience within the security field.


If you have thoughts or suggestions for this course, please contact Cloud Academy at


Like any discussion about a technical computational method like risk analysis, we need to have definitions with which to work. So let's begin with those. First, what is risk? Well, we all have an idea of what risk is but in this particular context, we need to understand it so that we know what we're computing, and what the result will mean.

First, risk is the probability of harm occurring. That is to say it is a probability. It is also the level of financial impact. Inherent risk is the total risk that we have before any controls or any newer controls are introduced. And the residual risk is that risk that remains after all cost-effective reductions are performed.

Risk management is the process of performing all of these things. The decision-making, the computation and so on with respect to drive decisions about how the risk will be dealt with. Risk assessment itself is the analysis of an environment, which we would call scope for this problem, to determine the presence and character of threats, vulnerabilities, impacts, possible mitigation options and potential outcomes of realized events upon assets, operations and people.

Risk assessment is typically done in a hybrid of two forms. One is qualitative, which is in its performance, a subjective process that uses subject matter expert and historical events and their outcomes to determine whether we think the risk is something that we can tolerate or not. We have the quantitative, which is more of an objective process that relies on models or impacts and relies very heavily on numerical values, such as probabilities and dollar values.

The fact is whatever process you use, it will be a hybrid of these two: Qualitative to envision a scenario of outage, and quantitative which will put numbers and probabilities to all these. Then we have mitigation, which is an action that reduces the probability or the consequence of a threat.

Now, mitigation is an active process to oppose the threat and the damage that it can cause. We have, of course, the asset, and this is a resource or the data itself required for organization operations. Assets must have a value in order to judge what sort of mitigation strategy we're going to use commensurate with that value. So this method of determining or assigning value is how we make that judgment and typically, the asset valuation method should be something either identical to or very similar to the sort of asset valuation methods the business context uses under normal operations. 

We have threats and the threat agent. The threat is an event that produces harm and the threat agent is the causative factor. For example, a flood is a threat, the damage that it can cause by the flood, and a hurricane is what causes the flood, and so here we have the threat, the flood, and the threat agent or hurricane that causes it. We have vulnerabilities, and this is any characteristic of an asset through which harm can be caused.

A vulnerability can also exist within a control structure if that control is weak or out of date. An exposure is an exploitable type of vulnerability or in the case of financial operations, exposure is the degree to which you're exposed to a financial loss. We have safeguards and controls, which are considered to be proactive, things that we put in place to prevent something from happening in the first place or things that we may design and build in for that same purpose.

Then we have countermeasures. These are considered to be reactive measures or actions that respond to oppose risks and threats as they occur. And an attack. An attempt to perform undesired or unauthorized actions that will result in harmful consequences.

Now, not everything is considered an attack. Some things are purely events, some things are purely failures. An attack tends to indicate an aggressive, hostile action taken against an asset or a target. That is not always the case. But this term is used in the generic sense to indicate that something undesired or unauthorized is taking place that will result in something harmful.

About the Author
Learning Paths

Mr. Leo has been in Information System for 38 years, and an Information Security professional for over 36 years.  He has worked internationally as a Systems Analyst/Engineer, and as a Security and Privacy Consultant.  His past employers include IBM, St. Luke’s Episcopal Hospital, Computer Sciences Corporation, and Rockwell International.  A NASA contractor for 22 years, from 1998 to 2002 he was Director of Security Engineering and Chief Security Architect for Mission Control at the Johnson Space Center.  From 2002 to 2006 Mr. Leo was the Director of Information Systems, and Chief Information Security Officer for the Managed Care Division of the University of Texas Medical Branch in Galveston, Texas.


Upon attaining his CISSP license in 1997, Mr. Leo joined ISC2 (a professional role) as Chairman of the Curriculum Development Committee, and served in this role until 2004.   During this time, he formulated and directed the effort that produced what became and remains the standard curriculum used to train CISSP candidates worldwide.  He has maintained his professional standards as a professional educator and has since trained and certified nearly 8500 CISSP candidates since 1998, and nearly 2500 in HIPAA compliance certification since 2004.  Mr. leo is an ISC2 Certified Instructor.