Question
Under the ASIS General Security Risk Assessment Guideline , what is the technical distinction between Threat , Vulnerability , and Asset Value when formulating a Quantitative Risk Model?
Tap card to flipAnswer
Threat: Any potential intent, capability, or natural event that can disrupt, damage, or compromise an asset (measured qualitatively or as an Annualized Rate of Occurrence, ARO). Vulnerability: A flaw, weakness, or absence of security controls that can be exploited by a threat to gain unauthorized access or cause damage (measured as a probability or percentage of successful exploitation). Asset Value: The monetary value or operational criticality of a tangible or intangible asset, including replacement cost, lost revenue, legal liabilities, and reputational damage. Risk Formulation: Risk = Threat × Vulnerability × Asset Value. In financial security models, this maps to ALE = ARO × SLE.
Tap card to flip back