write:Insecurity riskisbasedontheanalysisandaggregationofthreewidelyrecognizedfactors:threat vulnerability andconsequence. ConditionalriskAmeasureofriskthatfocusesonconsequences vulnerab

threat.Whentheprobabilityandconsequencesareexpressednumerically
theexpectedriskiscomputedastheproductofthosevalueswithuncertaintyconsiderations….Insecurity
riskisbasedontheanalysisandaggregationofthreewidelyrecognizedfactors:threat
vulnerability
andconsequence.ConditionalriskAmeasureofriskthatfocusesonconsequences
vulnerability
andadversarycapabilities
butexcludesintent.Itisusedasabasisformakinglong-termriskmanagementdecisions.Theadversarycapabilities
countermeasures
andresidualvulnerabilityareoftencombinedintoameasureoflikelihoodofadversarysuccess.ConsequenceTheoutcomeofaneventoccurrence
includingimmediate
short-andlong-term
directandindirectlossesandeffects.Lossmayincludehumancasualties
monetaryandeconomicdamages
andenvironmentalimpact
andmayalsoincludelesstangibleandthereforelessquantiÞableeffects
includingpoliticalramiÞcations
decreasedmorale
reductionsinoperationaleffectiveness
orotherimpacts.ThreatAnyindication
circumstance
oreventwiththepotentialtocausethelossof
ordamageto
anassetorpopulation.Intheanalysisofrisk
threatisbasedontheanalysisoftheintentionandcapabilityofanadversarytoundertakeactionsthatwouldbedetrimentaltoanassetorpopulation.VulnerabilityAnyweaknessinanassetÕsorinfrastructureÕsdesign
implementation
oroperationthatcanbeexploitedbyanadversary.Suchweaknessescanoccurinbuildingcharacteristics
equipmentproperties
personnelbehavior
locationsofpeople
equipmentandbuildings
oroperationalandpersonnelpractices.OnepurposeofthisarticleistoshowhowtheconceptofÒreasonableworstcaseÓcanbemademorepreciseinsomeapplicationsbyassumingthatintelligentattackersoptimize(and
wherenecessary
adaptinlightofnewinformation)theirattackplanstomaximizetheexpecteddamageachieved.How-ever
modelingtheoptimizingbehaviorsofattack-ersrequiresriskassessmentmodelsdifferentfromEquation(1).ThefollowingsectionssurveysomeimportantlimitationsonapproachesthatattempttodirectlyestimateRisk=Threat×Vulnerability×Consequenceforpurposesofallocatingdefensivere-sources
withoutmodelingintelligentplanningandoptimizationbyattackers.2.RAMCAPTMQUALITATIVERISKASSESSMENTBeforeconsideringmorefundamentallimita-tionsofEquation(1)
weÞrstconsidersomeßawsinthespeciÞcimplementationoftheequationinRAMCAPTM.RAMCAPTMproposestwooptionsforriskassessment
whichitcallsÒqualitativeÓandÒquantitative
Óalthoughbotharebasedonsemiquantitative(orderedcategorical)ratingsofThreat
Vulnerability
andConsequence.TheÒqual-itativeÓapproach(whichmightalsobecalledsemi-quantitative)categorizeseconomicconsequencesus-ingthefollowingratingscale:0=$0Ð25Mloss;1=$25Ð50M;2=$50Ð100M;…;13=$102Ð401Mandabove.Fatalitiesandinjuriesarescoredsimilarly:0=0Ð25fatalities
1=25Ð50fatalities
…
13=102
401fatalitiesormore
withasimilarratingscalefornum-berofinjuries.(Severityofinjuriesisnotincludedintheinjuryscore.)(TheRAMCAPTMtablesactu-allyleavesmallgapsbetweenintervals
e.g.
$0Ð25M
$26Ð50M
$51Ð100M
etc.
sothatconsequencessuchas$25.4Mor$50.7Mdonotfallinanycategory.WeassumethatÒ26Óincludesvaluesgreaterthan25andlessthan26
andsimilarlyforothergaps.)Vulnerabilityisassessedsimilarly
usingaÒlike-lihoodofattacksuccessscaleÓthatassignsascoreof0tosuccessprobabilitiesbelow0.0312;1toproba-bilitiesfrom0.0312to0.0625;2toprobabilitiesfrom0.0625to0.125;3toprobabilitiesfrom0.125to0.25;4toprobabilitiesfrom0.25to0.5;and5toprobabil-itiesabove0.5.(ProbabilitiesinÒbinÓ5arefurthersubdividedinto0.5Ð0.75
0.75Ð0.9
andgreaterthan0.9.)TheRAMCAPTMdocumentationsuggestsus-ingeventtreeanalysistoestimatethelikelihoodofattacksuccess.Ineventtreeanalysis
differ-entpossiblesequencesofeventsarerepresentedbycorrespondingsequencesofnodesinatree(adirectedacyclicgraphinwhicheachnodehasauniqueparent
exceptfortheÞrstorÒrootÓnode
whichrepresentsaninitiatingeventsuchasÒAttackattemptedÓ).Nodesrepresentevents
multiplearcs