University Of Arizona

MIS 516

FAIR Basic Risk Assessment Form
See Appendix A: Basic Risk Assessment Guide in An Introduction to Factor Analysis of Information Risk
(FAIR) by Jack Jones for instruction on filling out this form.
Stage 1 – Identify Scenario Components
Step 1 – Identify the Asset(s) at risk
Asset(s) at risk: Customer PII
Step 2 – Identify the Threat Community
Threat community: Cyber Criminal
Characterization
Employee’s account could be compromised with malware. This way a cyber criminal could gain access to
customer’s PII using inappropriate privileges of the compromised account.
Derived from Appendix A: Basic Risk Assessment Guide in An Introduction to Factor Analysis of
Information Risk (FAIR) by Jack Jones Page 1 of 4
Stage 2 – Evaluate Loss Event Frequency
Step 3 – Threat Event Frequency (TEF)
Rating ü Description
Very High (VH) ☐ > 100 times per year
High (H) ☐ Between 10 and 100 times per year
Moderate (M) ☐ Between 1 and 10 times per year
Low (L) ☐ Between .1 and 1 times per year
Very Low (VL) ☒ < .1 times per year (less than once every ten years)
Rationale: For this estimate we use the reported rate at which malware compromised employee’s
accounts through the entire organization (~10,000 people). We assume that accounts with inappropriate
privileges are compromised at the same rate. We also assume that every time cybercriminal gains access
through inappropriate privileged user they use this access.
Step 4 – Threat Capability (Tcap)
(If not directly estimating Vulnerability)
Rating ü Description
Very High (VH) ☒ Top 2% when compared against the overall threat population
High (H) ☐ Top 16% when compared against the overall threat population
Moderate (M) ☐ Average skill and resources (between bottom 16% and top 16%)
Low (L) ☐ Bottom 16% when compared against the overall threat population
Very Low (VL) ☐ Bottom 2% when compared against the overall threat population
Rationale: Cybercriminal would already have full access after gaining control of the employee’s account
in this scenario
Step 5 – Resistance strength (RS)
(If not directly estimating Vulnerability)
Rating ü Description
Very High (VH) ☐ Protects against all but the top 2% of an avg. threat population
High (H) ☐ Protects against all but the top 16% of an avg. threat population
Moderate (M) ☐ Protects against the average threat agent
Low (L) ☐ Only protects against bottom 16% of an avg. threat population
Very Low (VL) ☒ Only protects against bottom 2% of an avg. threat population
Rationale: Threat community already has inappropriate level of access.
Step 6 – Vulnerability (Vuln)
Tcap (from step 4): VH
CS (from step 5): VL