Whenever an organization performs a risk assessment, they try to consider multiple variables based on the user, asset, criticality, location, and many technical criteria like hardening, exploits, vulnerabilities, risk surface, exposure, and maintenance. A complete risk assessment model is a daunting task to manually complete if you consider all the possible vectors and methodologies to actually quantify the risk.
In general, risk assessments start with a simple model (as shown in Figure 3-1) and each vector gets ...
