Risk as likelihood and impact

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. Which describes risk in cyber security?

A How likely a threat is to succeed combined with how much harm it would cause

B Only how many hackers exist in the world

2. A threat is very likely to happen and would cause severe harm. What is the risk rating?

A High risk

B Low risk

3. A threat is very unlikely to succeed and would cause only minor harm. What is the risk rating?

A High risk

B Low risk

4. Which question helps you rate LIKELIHOOD?

A How much money would we lose?

B How easy or common is this attack?

5. Which question helps you rate IMPACT?

A How much harm would it cause if it worked?

B How often do attackers try this?

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1risk = likelihood x impact		AThe threat is very likely to succeed, for example because it is common or the defences are weak
2likelihood = "high"		BRisk depends on the asset. The same threat can cause far more harm to one asset than to another.
3Impact is rated by how much harm a successful attack would cause		Cphishing on school wifi password: risk = low phishing on admin account: risk = high
4The same threat can have different risk for different assets		Dimpact = "high"
5likelihood = "high", impact = "low", so risk = "ignore it"		ERisk combines how likely a threat is to succeed with how much harm it would cause
6Phishing has the same risk for every asset, so rate them all the same		FRisk is not decided by likelihood alone. Even a low-impact threat that is very likely still needs a rating and some attention.

Definitions

risk = likelihood x impact

Fill in the Blanks

Complete each line of code by filling in the missing parts.

risk = __________ x impact

# Harm if the attack works risk = likelihood x ______

risk = likelihood _ impact

__ asset = "student records" impact = "high" risk = likelihood x impact

likelihood = "medium" ______ = "high" risk = likelihood x impact

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A threat <- "phishing email"

B likelihood <- "high"

C impact <- "often"

D risk <- "high"

Question 2

A likelihood <- "low"

B impact <- "high"

C risk <- likelihood x likelihood

D OUTPUT risk

Question 3

A asset <- "exam results"

B impact <- "low"

C likelihood <- "medium"

D risk <- "high"

Question 4

A risk <- likelihood - impact

B IF risk = "high" THEN

C OUTPUT "Fix this first"

D ENDIF

Question 5

A threat <- "daily phishing"

B likelihood <- "low"

C impact <- "medium"

D risk <- "high"

Answer Key

Risk as likelihood and impact

Section A: Quick Questions

A — How likely a threat is to succeed combined with how much harm it would cause

A — High risk

B — Low risk

B — How easy or common is this attack?

A — How much harm would it cause if it worked?

Section B: Match the Pairs

risk = likelihood x impact → Risk combines how likely a threat is to succeed with how much harm it would cause

likelihood = "high" → The threat is very likely to succeed, for example because it is common or the defences are weak

Impact is rated by how much harm a successful attack would cause → impact = "high"

The same threat can have different risk for different assets → phishing on school wifi password: risk = low phishing on admin account: risk = high

likelihood = "high", impact = "low", so risk = "ignore it" → Risk is not decided by likelihood alone. Even a low-impact threat that is very likely still needs a rating and some attention.

Phishing has the same risk for every asset, so rate them all the same → Risk depends on the asset. The same threat can cause far more harm to one asset than to another.

Section C: Definitions

risk = likelihood x impact — Risk is how likely a threat is to succeed combined with how much harm it would cause. Rate each as low, medium or high to decide which risks matter most.

Section D: Fill in the Blanks

risk = likelihood x impact

# Harm if the attack works
risk = likelihood x impact

risk = likelihood x impact

IF asset = "student records"
  impact = "high"
risk = likelihood x impact

likelihood = "medium"
impact = "high"
risk = likelihood x impact

Section E: Spot the Error

C — Impact is rated low, medium or high. "often" describes how frequently something happens, which is likelihood. It should be impact <- "medium".

C — Risk combines likelihood AND impact. Multiplying likelihood by itself ignores how much harm the threat would cause. It should be risk <- likelihood x impact.

B — If exam results were leaked or changed, the harm would be serious, so the impact is high, not low. It should be impact <- "high".

A — Risk combines likelihood and impact (likelihood x impact). Subtracting one from the other is not how risk is worked out. It should be risk <- likelihood x impact.

B — A threat that shows up every day is very likely to be tried, so its likelihood is high, not low. It should be likelihood <- "high".