FAIR Methodology for Cyber Risk Quantification

FAIR Risk Analysis Methodology

What is FAIR?

Factor Analysis of Information Risk (FAIR) is the only international standard quantitative model for information security and operational risk.

FAIR Taxonomy

Risk Definition

Risk = Probable Frequency × Probable Magnitude of Loss

Loss Event Frequency (LEF)

How often will a loss occur?

Components:

• Threat Event Frequency (TEF)

  • How often do threat agents act against assets?

• Vulnerability (Vuln)

  • Probability action results in loss
  • Function of Threat Capability vs. Control Strength

Loss Magnitude (LM)

How much will be lost when it occurs?

Primary Loss:

• Productivity loss
• Response costs
• Replacement costs

Secondary Loss:

• Secondary stakeholders (regulators, customers)
• Fines and judgments
• Competitive advantage loss
• Reputation damage

FAIR Analysis Process

Step 1: Scope the Risk Scenario

• Identify the asset
• Identify the threat community
• Identify the loss scenario (confidentiality, integrity, availability)

Step 2: Estimate Threat Event Frequency

• How often does the threat community attempt this?
• Use historical data, industry benchmarks
• Express as range (min, most likely, max)

Step 3: Estimate Vulnerability

• What is the probability of success?
• Consider control strength
• Consider threat capability
• Express as percentage range

Step 4: Calculate Loss Event Frequency

LEF = TEF × Vulnerability

Step 5: Estimate Loss Magnitude

For each loss type:

• Primary losses (direct, immediate)
• Secondary losses (indirect, delayed)
• Use ranges, not point estimates

Step 6: Run Monte Carlo Simulation

• 10,000+ iterations
• Generate loss distribution
• Calculate statistics

Key Outputs

• Loss Exceedance Curve: Probability of exceeding loss amounts
• Annual Loss Expectancy (ALE): Average expected loss per year
• Value at Risk (VaR): Loss at specific confidence level

Calibration Tips

• Use probability ranges, not point estimates
• Anchor to historical data when available
• Decompose complex estimates
• Track predictions vs. actuals
• Regular recalibration

Use Cases

• Prioritize security investments
• Justify budget requests
• Compare risk scenarios
• Insurance decisions
• Regulatory discussions