ABCDEFGHIJKLMNOPQRSTUVWXYZ
1
Control-based Risk Assessment Methodology

The proposed method involves the following main steps:

1- Identification of Threats and Relevant Controls:
Using STRIDE for threat identification and together identify the relavant security controls.

2- DREAD Factor Mapping:
For each control, evaluate its impact on the DREAD factors. This mapping will determine whether a control influences a particular DREAD factor and to what extent.

DREAD stands for Damage, Reproducibility, Exploitability, Affected Users, and Discoverability.

Damage: Refers to the potential impact that a vulnerability could have on the target. The target can be the organization, the system in question, or other users in general.
Reproducibility: Refers to how easily the vulnerability can be reproduced by an attacker.
Exploitability: Refers to how easy or difficult it is to exploit the vulnerability.
Affected Users: Refers to the number of users who could be affected by the vulnerability.
Detectability: Refers to how likely/easy it is for defenders to notice the attack or exploitation.

3- Control Effectiveness Levels:
Define different implementation levels for each control (Basic, Intermediate, and Advanced) and assess how the effectiveness at each level impacts the DREAD factors.

4- Quantitative Risk Assessment:
Utilize the mappings and implementation levels to conduct a quantitative risk assessment, focusing on two main elements: impact (Damage and Affected Users) and likelihood (Reproducibility, Exploitability, and Discoverability).
Additionally, since in some cases it is possible some controls has a strenght power among others for reducing the risk of a threat, we can use a weighting system (to assign different levels of weights) for the controls associated to a threat.


Weighting Approach steps:

1- Define Weighting Criteria
We can use one (or more) of the following criteria to determine the weights:

Effectiveness: How well the control mitigates the threat.
Implementation Ease: How easily the control can be implemented and maintained.


2- Assign Weight Values
For simplicity using a 3-point scale:

Strong: 3 points
Moderate: 2 points
Weak: 1 point

3- Calculate and Normalize the weights
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100