Why Use Matrix-Type Models for Risk Assessment?

Last Updated on November 19, 2024

In the course of helping our clients achieve ISO 27001 certification or implement an information security management system (ISMS) or information security controls in general, one of the first things we need to do is assess their current environment. What are the threats they actually face? What aspects of the environment are vulnerable to the threats?, if a risk and a vulnerability did “intersect” as an occurrence, what would the risk impact be? And how likely is it that a specific risk would actually occur?
As we look at risks, probabilities and impacts together with clients, our overall goal is to identify the most critical areas where the business may face unacceptable risk. These areas will require the highest-priority controls you want to implement first. Simple, right?
Well… in theory the process sounds simple enough. But in practice, in order to yield meaningful results that actually protect an organization optimally and make the best use of its resources, the analysis has to be undertaken thoughtfully. Indeed, research on this process shows that reflection on risk attitudes and the subjective judgments that follow from them is one of the most critical factors often missing from risk analysis.
To support accurate risk assessment as well as facilitate meaningful risk discussions, Pivot Point Security recommends using a risk matrix with our clients. Especially for SMBs, and/or if this is the first time an organization has thought about risk in a structured way, notwithstanding factors to the contrary we often recommend a straightforward, 3×3 matrix like the one shown below.

This type of matrix shows event consequences along one axis (the bottom in the illustration) and event frequency or likelihood along the other (the left in this case). Each block in the matrix represents some level of risk. Blocks representing equivalent risk form “groupings” within the matrix, shown here as green, yellow and red.
A simple matrix like this can cover all kinds of risks and impacts, and to display them to support discussion, decision-making and even status tracking. Experience shows that the best results come from keeping the scales for these ratings simple and clear; e.g., low, medium and high risk probability and low, medium and high impact. (Or you can use numbers; e.g., 1, 2, 3.)
From there you can define what you want “low,” “medium” and “high” (or 1, 2 and 3) to mean. For example, a client I worked with recently defined their scale as follows:

• Low probability = Would hardly ever happen.
• Medium probability = Could happen.
• High probability = Will most likely happen.
• Low impact = One day’s worth of work with no client impact.
• Medium impact = A week’s worth of work with two out 100 clients impacted.
• High impact = An ongoing effort to remediate an issue across all clients.

Of course, anytime you’re trying to determine how probable something is that hasn’t happened yet, there is bound to be some subjectivity involved—but you try not to be arbitrary. Again, the primary goal is to identify the highest-priority risk issues that you want to remediate first.
In the case of a 3×3 matrix, “Low x Low” clearly presents the lowest risk and “High x High” the highest. The “intermediate” (yellow in the illustration) risks are more difficult to interpret/prioritize because some are directly comparable and some are not.
Every form of risk matrix has its advantages and disadvantages and there’s no “one size fits all” approach that works for every business. That’s why Pivot Point maintains an extensive library of them, along with documentation on how well they worked and why. We’ve seen just about every approach possible.
In my personal experience, in terms of matrix complexity it’s rare to see significant benefit when you go beyond 5×5. Compared with 3×3, a 5×5 matrix obviously provides more granularity/specificity as to the level of risk.
That can be useful for prioritizing risks, but definitely requires more thought and consideration to make the delineations (e.g., Critical, High, Medium, Low, Negligible) relevant due to the greater subjectivity and potentially greater communication challenges involved. On the plus side, feeling like you’ve more clearly defined the relative impact and probability of issues can enhance your ability to allocate time, money and staff to remediation efforts.
Again, risk assessment isn’t a “black-and-white” exercise. This is a big reason why it can be very useful to have skilled, experienced professionals supporting the process—especially if you prefer to use a richer framework like a 5×5 matrix.
Speaking of complexity, another factor that we often apply risk assessment to help think about impact is security areas or objectives; e.g., health & safety, financial impact, confidentiality, integrity, availability and/or reputation. Instead of just thinking about “impact” in general, we discuss impact relative to these specific areas or factors to build a more holistic risk profile. You can do this whether you’re working with a 3×3 matrix, a 5×5 matrix or no matrix at all. (You can check out a sample 5×5 matrix describing consequences across multiple objectives here.)
For example, take a hurricane (which we literally did a few years back here in New Jersey): it could have a high impact on health & safety and a high impact on availability but a low impact on reputation. Your clients would probably understand if you had excessive downtime due to an “act of God” … unless people were hurt or killed because you failed in some major way to put controls in place deal with the hurricane’s impact.
The bottom line here is just to get everybody thinking and talking clearly about your organization’s specific risk probabilities and impacts in a useful way. Starting simple doesn’t mean your results will be simplistic or less meaningful. Just the opposite: starting simple can yield clarity and a solid foundation for risk remediation. Over time you can add complexities and refine outcomes if that proves to be helpful.
To start a conversation about risk assessment issues and variables for your organization, contact Pivot Point Security.

Potential Impact Definitions for Security & Business Objectives