Quantifying Cyber Risk with FAIR: A Worked Example

Quantifying Cyber Risk with FAIR: A Worked Example

Quantifying cyber risk is crucial for effective risk management. One approach that has gained traction is the Factor Analysis of Information Risk (FAIR) framework. In this article, we'll walk through a worked example using this methodology.

What is the FAIR Framework?

FAIR is an open-source, actuarial-based methodology that allows risk analysts to quantify and manage cyber risks in financial terms. It is based on risk scenarios, threat events, asset impact, and vulnerabilities (FAIR.org).

Setting up the Risk Analysis

Let's consider a hypothetical e-commerce company, CybCo, with an annual revenue of $10 million. The company stores customer sensitive data, which can incur a regulatory fine of up to $5 million in case of a breach (EU General Data Protection Regulation).

Defining the Risk Scenario

For this example, we'll focus on the risk scenario of a cyber attack leading to a data breach. We'll consider two attack vectors:

1. Phishing attack targeting employees
2. Advance persistent threat (APT) through network vulnerabilities

Quantifying Threat, Vulnerability, and Impact

Threat Frequency

• Phishing: 100 attempts per month, probability of successful attack: 1%
• APT: 1 attempt per quarter, probability of successful attack: 20%

Vulnerabilities

• Phishing: The company trains employees annually, but the training is outdated and ineffective.
• APT: The company updates software regularly, but there's an unknown, undisclosed zero-day vulnerability.

Impact

• Data Breach: The breach would compromise 100,000 customer records, exposing sensitive data.

Calculating Expected Monetary Loss (EML)

We can now calculate the EML for each threat event.

Phishing Attack

1. Frequency: 100 * 0.01 = 1 successful attack every 1000 attempts
2. Impact: Based on the EU fine, the impact of a breach is the greater of $5 million or the expected financial loss due to regulatory fines, lawsuits, and reputational damage.
3. Expected financial loss: Let's assume the financial loss due to regulatory fines, lawsuits, and reputational damage is approximately $2.5 million. Expected financial loss = $2.5 million x (1 successful attack / 1000 attempts) = $250,000
4. EML = Expected financial loss = $250,000

APT

1. Frequency: 1 * 0.2 = 0.2 successful attacks per quarter
2. Impact: As in the phishing example, let's assume the financial loss due to regulatory fines, lawsuits, and reputational damage is approximately $2.5 million.
3. EML = Expected financial loss = $2.5 million x 0.2 successful attacks per quarter = $500,000 per year

Key Takeaways

1. The FAIR Framework provides a structured approach to quantifying cyber risks.
2. By calculating EML, organizations can make informed decisions about risk treatments and allocate resources effectively.
3. Identifying and addressing vulnerabilities is crucial in mitigating cyber risk.
4. Risk quantification helps focus efforts on high-impact threats, ultimately reducing business disruption and financial loss.
5. Regular risk assessments are necessary to ensure that the risk analysis remains up-to-date and effective.