Assessing Risk

Lesson plan

Level

Intermediate

Time

About 55 minutes; the steps below add up to 55

Learners start by weighing two school problems and discover that they need both likelihood and impact, and shared definitions of each, to agree. The lesson then gives them the vocabulary (qualitative and quantitative, ordinal), defined 5 × 5 scales and a rating panel that shows equal scores hiding different risks. It ends with the CVSS distinction: a severity score describes a weakness, and the organisation's facts turn it into a risk.

Objectives

• Explain the difference between qualitative and quantitative risk assessment, and when each helps
• Rate a risk on defined 5 × 5 scales and place it in a band
• Explain why matrix scores are rankings, not measurements, and why equal scores can need different responses
• Explain why a CVSS score describes a weakness, not the risk to a particular organisation

Before the lesson

• Open this page on your own screen and use “Open the lesson window” to open the lesson in a second window. Share only that second window.
• Try the rating panel once with 1 × 5 and 5 × 1, then reset it from this page.
• Learners need the Risk lesson first: assets, threats, vulnerabilities, likelihood and impact.
• The lesson takes about 55 minutes.
• In presentation mode every step is shown in turns: Next reveals one moment, part or answer at a time, and the instructor view names what is on screen and what comes next.

Steps

1. Introduction Opening

   On screen: the lesson’s title, module and number; Next adds its objectives and key terms, as the lesson page lists them; Next again begins the first step.

   Objectives on screen

   • Explain the difference between qualitative and quantitative risk assessment, and when each helps
   • Rate a risk on defined 5 × 5 scales and place it in a band
   • Explain why matrix scores are rankings, not measurements, and why equal scores can need different responses
   • Explain why a CVSS score describes a weakness, not the risk to a particular organisation

   Purpose: Learners start by weighing two school problems and discover that they need both likelihood and impact, and shared definitions of each, to agree. The lesson then gives them the vocabulary (qualitative and quantitative, ordinal), defined 5 × 5 scales and a rating panel that shows equal scores hiding different risks. It ends with the CVSS distinction: a severity score describes a weakness, and the organisation's facts turn it into a risk.

2. 1. Which problem first? Think 6 min

   Purpose: Discover from a familiar choice that ranking risks needs both likelihood and impact, and agreed definitions of each.

   Ask

   • The roof or the wiring: which would you fix first? Why?
   • Would two people agree, unless they used the same meaning for “likely” and “bad”?

   Responses to expect

   • The room usually splits. That is the point: disagreement comes from weighing two things without shared definitions.
   • On screen in turns: the opening; then the question on the roof or the wiring, and its answer.

   Discussion pause: Take a quick vote, then ask one person from each side to give their reason.

   In the lesson window

   • Think it through: Which would you fix first, and what did you have to weigh up to decide?

3. 2. Qualitative and quantitative assessment Explain 9 min

   Purpose: Introduce qualitative and quantitative assessment, ordinal ratings and the defined 5 × 5 scales.

   Ask

   • Is a likelihood of 4 twice as likely as a 2?

   Responses to expect

   • Many say 4 is twice 2; use finishing positions in a race.
   • On screen in turns: the opening; then Risk = Impact × Likelihood; qualitative assessment; quantitative assessment; the check question on ratings of 4 and 2, and its answer; the organisation’s written scales, with impact held back; what each impact score means; the 5 × 5 matrix.

   Misconceptions to challenge

   • A learner may believe: “A score of 20 means twice the risk of 10.” Respond: Ratings are rankings. The steps between them are not equal.
   • A learner may believe: “Numbers make the assessment objective.” Respond: They organise judgements; the definitions and evidence behind them decide their worth.

   Discussion pause: The impact definitions are held back: ask what a 1 and a 5 should mean for this organisation before revealing them.

   If the explanation does not land: Use school grades: a grade 8 is better than a grade 4, but nobody claims it is twice as good.

   In the lesson window

   • Check your understanding: On a 1 to 5 scale, risk A has a likelihood of 4 and risk B a likelihood of 2. What can you say?

4. 3. Try it: rate a risk Experiment 9 min

   Purpose: Let learners rate risks in the panel and see what a score hides, then rate one risk before and after a control.

   Ask

   • rare disaster (1 × 5) or frequent nuisance (5 × 1), which is the bigger risk?
   • In the panel, find every rating that scores 4. Do they all deserve the same response?

   Responses to expect

   • In the panel, learners find 1 × 4, 2 × 2 and 4 × 1 tie, and should argue they need different responses.
   • Panel: the question and the panel are on screen when the step opens, so the instructor view’s jump to this step lands on the panel.
   • On screen in turns: the opening question, its answer; then the limits of ordinal scoring, starting with unequal intervals; the product hides differences; labels need definitions; boundaries are choices; the matrix supports, not replaces, judgement; the customer-database risk, before stronger access controls; after stronger access controls.

   In the lesson window

   • Think it through: Risk C: likelihood 1, impact 5, a rare disaster. Risk D: likelihood 5, impact 1, a frequent nuisance. Before you try the panel: which is the bigger risk?
   • Risk rating

5. 4. Choosing between qualitative and quantitative assessment Explain 5 min

   Purpose: Show when each kind of assessment helps, and that organisations use both.

   Ask

   • Is a £40,000 control worth buying? Which assessment tells you?

   Responses to expect

   • Quantitative: pounds against pounds. Some will argue a Very high band is enough; ask what the band says about £40,000.
   • On screen in turns: the opening; then qualitative and quantitative compared, starting with qualitative; the quantitative column; many organisations use both; the check question on whether a control is worth the money, and its answer.

   In the lesson window

   • Check your understanding: A board must decide whether a £40,000 control is worth buying to reduce one particular risk. Which kind of assessment helps most with that decision?

6. 5. Technical severity and business risk Discover 12 min

   Purpose: Separate a weakness's technical severity from the risk to a particular organisation, with a fully worked rating of two systems.

   Ask

   • Same 9.8 weakness on two systems: same risk?
   • What would change if System B were not really isolated?

   Responses to expect

   • Most see the difference quickly. Push on the test system: “not real data” is not “no risk”.
   • Reveal the ratings of System A and System B one line at a time; ask for each rating, with a reason, before it appears.
   • On screen in turns: the opening; then the question on the same score on two systems, and its answer; a CVSS score is not a business-risk assessment; two systems with the same weakness; rating System A and System B, starting with A’s likelihood; A’s impact; A’s score; B’s likelihood; B’s impact; B’s score; the result; changing one fact; the working runs one way only; FIRST’s guidance on context; what the security report should say.

   Misconceptions to challenge

   • A learner may believe: “A CVSS 9.8 finding must always be fixed first.” Respond: Priority also depends on exposure, impact and existing controls.
   • A learner may believe: “A test system has no risk.” Respond: Check the claim. A test system can be a stepping stone to a real one.

   Discussion pause: Ask pairs to rate System B again after the “change one fact”.

   In the lesson window

   • Think it through: The same weakness, scored CVSS 9.8, is found on two systems: an internet-facing application full of customers’ details, and an isolated test system holding made-up data. Is the risk the same on both?

7. 6. Evidence-based, not fear-based Explain 3 min

   Purpose: Make the habit explicit: record the reasons and evidence behind every rating.

   Ask

   • What would someone need to see to check your rating of System A?

   Responses to expect

   • The scenario, the ratings with reasons, the evidence, the owner and a review date.
   • On screen in turns: the opening; then an assessment someone else can review.

8. 7. Apply it in a new situation Apply 4 min

   Purpose: Set up independent application, ideally on a later day.

   Ask

   • Who will try these now, and who later in the week?

   Responses to expect

   • The college question checks that equal scores are not equal plans; the printer question checks the CVSS distinction.
   • On screen in turns: the opening; then the question on equal scores and the same plan, and its answer; the question on a printer scored 9.8, and its answer.

   In the lesson window

   • Apply it: A college rates two risks: a flood in the basement server room (likelihood 1 × impact 5) and printer jams during exams (likelihood 5 × impact 1). A manager says: “Both score 5, so they need the same plan.” What is the best response?
   • Apply it: A scan reports a CVSS 9.8 weakness on an office printer that can be reached only from one small, isolated network. The manager wants everyone to stop work and fix it today. What should come first?

9. 8. Check your understanding Check 4 min

   Purpose: Check the lesson against the approved revision-bank questions.

   Ask

   • Answer individually, then compare before revealing.

   Responses to expect

   • The units question is the one most often missed.
   • On screen in turns: the opening; then the revision questions one at a time, each followed by its answer; where to practise next.

10. 9. What to remember Consolidate 3 min

    Purpose: Summarise the five points and the misunderstandings.

    Ask

    • Without looking: why is a matrix score not a measurement?

    Responses to expect

    • The ratings are ordinal: they put risks in order, with unequal steps.
    • On screen in turns: the opening; then the summary; the common misunderstandings.

11. Lesson recap Closing

    On screen: the lesson’s objectives again; Next adds the closing question, which asks the class to explain each one in their own words without looking back. It says nothing about what anyone has learnt: use the answers to decide what to revisit.

    Points to listen for

    • Qualitative assessment ranks with defined descriptions; quantitative assessment estimates with units.
    • Matrix scores are rankings; equal scores can hide different risks.
    • Scales need written definitions to be comparable.
    • CVSS describes a weakness; exposure and impact turn it into a risk.
    • Record the reasons and evidence behind every rating.

Consolidation

• Qualitative assessment ranks with defined descriptions; quantitative assessment estimates with units.
• Matrix scores are rankings; equal scores can hide different risks.
• Scales need written definitions to be comparable.
• CVSS describes a weakness; exposure and impact turn it into a risk.
• Record the reasons and evidence behind every rating.