Risk model

A risk model is the conceptual structure used to evaluate and manage the risks that come with threats and vulnerabilities in a digital environment.

It gives an organisation a systematic method for identifying, analysing and mitigating the risks that could affect it, its assets and its IT infrastructure.

Its practical value is that it turns a set of opinions into a repeatable measurement: two people applying the same model to the same scope should reach comparable answers, and that is what makes it possible to prioritise and to allocate budget with an argument behind it.

What a risk model contains

Asset identification. The first step is identifying and classifying the organisation’s critical information assets: confidential data, network systems, applications, hardware and software.

Threats and vulnerabilities. Once the assets are known, the threats and weaknesses that could affect them are analysed, internal and external alike.

Risk analysis. With assets, threats and vulnerabilities on the table, the analysis works out how likely each adverse event is and what it would cost if it happened.

Control evaluation. Existing controls are assessed for whether they actually reduce the risks identified: policies, procedures, security technology and management practice.

Risk treatment. Based on the analysis, mitigation is designed and implemented to lower either the likelihood or the impact, and what is left over is either accepted, transferred or avoided, on the record.

A worked example

A financial services company wants to evaluate and manage the digital risk in its IT estate.

Assets. It identifies its critical assets: customer financial data, transaction processing systems, storage servers.

Threats and vulnerabilities. It analyses the plausible threats, malware, phishing, denial of service, and the weaknesses in the network: missing patches, insecure configuration.

Analysis. It estimates how likely each event is, for instance malware compromising customer financial data, and what that would mean in reputational and financial terms.

Controls. It reviews what is already there, firewalls, intrusion detection, data access policy, and asks whether each one actually addresses the risks on the list.

Treatment. It puts additional measures in place: software updates, awareness training, tighter access control.

Risk model, threat modelling and risk analysis

Three similar names and three different things. It is the most expensive confusion in this part of the glossary, because it decides what gets bought.

Threat modelling reasons about a specific design: you draw the system with its trust boundaries and ask, piece by piece, how it could fail. STRIDE is the mnemonic that keeps that conversation ordered. It finds design flaws and says nothing about implementation flaws: it will tell you a boundary does not authenticate, and it will not see the injection in the code behind it.

The risk model is the structure an organisation values with: what counts as an asset, which scale measures likelihood and impact, and above which threshold a risk gets treated instead of accepted.

The risk analysis is the pass that applies that model to a specific scope and comes out with a prioritised list.

In one sentence: threat modelling looks at a system, the risk model is the ruler, and risk analysis is the measurement.

Above all three sits the management system (ISMS), which is what keeps the decisions and reviews them. A standard does not certify a list of controls: it certifies that this system works.