The FAIR Advantage: Data-Driven Decisions for Risk Management.

Imagine a data breach exposing millions of customer records. Traditional risk assessments, often reliant on subjective scales, struggle to communicate the true impact of such an event. Here’s where the Factor Analysis of Information Risk (FAIR) framework steps in. FAIR provides a structured approach to analysing, understanding, and quantifying operational and cyber risk in financial terms (Anderson 2018). FAIR’s data-driven approach to assess and prioritise cybersecurity risks compliments other risk frameworks which propose the necessity to quantify risk without offering guidance on how that should be achieved (FAIR Institute 2024). This formulaic approach to risk simples the process of quantifiable risk management, which is profound as it has been deemed by many as an impossible feat (Freund and Jones 2014).

A challenge of operational risk and information security professionals is the limitations of terminology in the domain of risk related communication (Freund and Jones 2014, ch 3). The intuitive terminology in FAIR simplifies the process of decomposing a risk into an ontological tree diagram of its components. In the process it elicits measurable factors like threat event frequency, vulnerability likelihood, and loss magnitude, which are used to apply probabilistic and loss metrics to a measurement algorithm, resulting in a quantifiable value (Yun, Cho et al. 2015).

FAIR delivers a clear picture of potential financial losses over time. It can calculate not just a single value, but also minimum, most likely, and maximum loss scenarios (Dreyling, Jackson et al. 2021). Additionally, the framework can be further enhanced using advanced data science techniques like Bayesian Networks (Wang, Neil et al. 2020) and Monte Carlo simulations (Hsu, Pan et al. 2023) resulting in accurate predictions.

  Impact on Risk Management: FAIR offers several benefits for risk management:

1. Quantitative Analysis: Moving away from traffic light charts and vague scales, FAIR allows organizations to better understand their exposure by expressing risk in financial terms.
2. Improved Decision Making: threats can be viewed in terms of financial impact. Allowing stakeholders to understand the potential losses and prioritise based on their potential impact on the organisation. Leading to better resource allocation and more effective risk management.
3. Consistency and Communication: FAIR provides a framework that reduces uncertainty an improves consistency in risk analysis. It helps risk professionals generate meaningful metrics that can be easily understood and communicated to stakeholders.
4. Risk prioritisation: By calculating the probable loss associated with each risk scenario, organisations can prioritise risks based on their potential impact. This allows them to focus on their resources on mitigating the most impactful risks first.
5. International Standard: FAIR creates a standardised model for communicating cybersecurity and operational risk.

Faced with implementing a novel e-service using Amazon Alexa for personal data, the government of Estonia lacked existing risk data (Dreyling, Jackson et al. 2021). They leveraged the FAIR framework to quantify the risk. Consulting cybersecurity experts for breach likelihood, they combined this with global breach data to run simulations. FAIR projected annualized loss exposure ranging from $0 (minimum) to $70,500 (most likely) to $6 million (maximum), providing decision-makers with tangible data to allocate resources for risk mitigation.

In conclusion, by offering a quantifiable and standardized approach to risk communication, FAIR empowers data-driven decision-making and prioritisation for a more secure IT environment.

References

FAIR Institute (2024). “What is FAIR?”. Retrieved 17/03/2024, 2024, from https://www.fairinstitute.org/what-is-fair.

Anderson, B. (2018). FAIR Vulnerability Determined using Attack Graphs. Athens, The Steering Committee of The World Congress in Computer Science, Computer Engineering and Applied Computing (WorldComp): 285-286.

Dreyling, R., et al. (2021). Cyber security risk analysis for a virtual assistant G2C digital service using FAIR model.

Freund, J. and J. Jones (2014). Measuring and managing information risk: a FAIR approach, Butterworth-Heinemann.

Hsu, T.-C., et al. (2023). An Approach for Evaluation of Cloud Outage Risk based on FAIR Model. 2023 International Conference on Engineering Management of Communication and Technology (EMCTECH), IEEE.

Wang, J., et al. (2020). “A Bayesian network approach for cybersecurity risk assessment implementing and extending the FAIR model.” Computers & security 89: 101659.

Yun, J. H., et al. (2015). FAIR-Based Loss Measurement Model for Enterprise Personal Information Breach. Advances in Computer Science and Ubiquitous Computing: CSA & CUTE, Springer.