Risk Assessment (Identification, Analysis, Evaluation)

#How a Spreadsheet Saved a Hospital From a Ransomware Nightmare#link

Distinguishing risk from threat and vulnerability was your first step. Now we turn that knowledge into action. When a mid‑sized hospital identified 23 critical assets and mapped their exposure, the risk assessment process revealed that a single unpatched PACS server could halt radiology for days. That insight forced an emergency change window — before any attacker found it. In this lesson, you’ll perform identification, analysis, and evaluation steps that transform guesswork into a defensible risk posture.

Step 1 — Identification: Asset, Threat, Vulnerability Triplets

Risk identification requires pairing every critical asset with the threats and vulnerabilities that can compromise it. Walk through your environment: servers, databases, cloud buckets, employee laptops, APIs. For each, list realistic threat sources — from disgruntled insiders to opportunistic ransomware gangs — and the vulnerabilities (missing patches, default credentials, lack of encryption). This produces a risk register, the foundational document for the entire process.

The command above reveals the hostname, active interfaces, critical services like nginx, and a backup cron job. Each becomes an asset row in your risk register. An attacker could target nginx via a web vulnerability, or attempt to tamper with the backup job to erase evidence.

Step 2 — Analysis: Quantifying Impact and Likelihood

Once risks are identified, you must estimate how likely they are to occur and what the impact would be if they did. Common methods include qualitative (High/Medium/Low) and quantitative (Annualized Loss Expectancy). A simple matrix multiplies likelihood by impact to produce a risk score. For example, a vulnerability with a public exploit (High likelihood) on a customer database (Critical impact) yields a risk score that demands immediate treatment.

# Simple risk score calculator
assets = [
    {"name":"Customer DB","likelihood":4,"impact":5},
    {"name":"Dev wiki","likelihood":2,"impact":2},
    {"name":"VPN gateway","likelihood":3,"impact":4}
]
for asset in assets:
    score = asset["likelihood"] * asset["impact"]
    print(f"{asset['name']}: Risk Score = {score}")

Step 3 — Evaluation: Prioritizing What Matters

Evaluation compares the calculated risk scores against your organization’s risk appetite. Not every critical risk gets fixed immediately if the cost exceeds the business benefit, but those that exceed the risk threshold must be treated. The output is a prioritised list that feeds directly into risk treatment strategies — avoid, mitigate, transfer, or accept — which you’ll master in the next lesson.

• ▪Identify assets, threats, vulnerabilities — build a risk register
• ▪Analyze using qualitative/quantitative methods — likelihood × impact
• ▪Evaluate against risk appetite — set your organisation’s risk threshold
• ▪Document everything — auditors and regulators expect a repeatable process