There are two fundamental types of risk analyses: quantitative and qualitative. Each method has pros and cons, and there is significant controversy over which approach is superior. In what is perhaps an indicator of the controversy surrounding this issue, even the definitions of the two approaches is somewhat controversial. I have attempted to offer as neutral a definition of these approaches as possible.
Many authors make the distinction between the two types of risk analyses very complicated, but the difference is really very simple. Quantitative Risk Analyses assign fixed numerical values (within a margin of error) to both the probability and utility (business impact) of an outcome; Qualitative Risk Analyses don’t. Instead, they represent both the probability and utility of an outcome using an interval scale, where each interval includes a range of numerical values (beyond the margin of error) and each interval is typically represented by a non-numerical label (such as the words “High”, “Medium”, “Low”), not the ranges of values those labels represent.
While we may draw a distinction between quantitative and qualitative RA (and in fact most security professionals do), I believe that we would be hard pressed to defend its significance, for the reasons usually given. In virtually every discussion of information security RA that I have seen, other writers assume that quantitative RA is objective and numerical while qualitative RA is subjective and non-numerical. As I argue below, however, this common view is mistaken. Both types of RA are numerical and both types are compatible with objective and non-objective estimates of probability. Moreover, within the scope of a single RA project, different methods can be used for different risks. The distinction between quantitative and qualitative RA is significant, but not due to the reasons that are typically offered.
Popularity: 27%
2 Comments
When you write like this, you will make the “schooled” security experts’ (those with all the education and none of the experience) head spin around. Throw “vulnerability” into the mix and explain that they are not “risks” and their heads will explode. I look forward to parts 2 and 3.
This is a concise, and well written introduction on the subject of Risk Analysis.
Looking forward to some articles on Contingency Planning.
One Trackback
[...] Lowder, J. (2008). “The Difference Between Quantitative and Qualitative Risk Analysis and Why it Matters (Part 1).” BlogInfoSec.org (link here). [...]