Difference between revisions of "Risk"
Jump to navigation
Jump to search
(→Switzerland) |
(→NIST) |
||
| Line 72: | Line 72: | ||
=====[[NIST]]===== | =====[[NIST]]===== | ||
{{definition|The level of impact on organizational operations (including mission,functions, image, or reputation), organizational [[Asset|assets]], or individuals resulting from the operation of an information system given the potential impact of a [[threat]] and the likelihood of that threat occurring. <ref name="NISTIR7298"> [http://nvlpubs.nist.gov/nistpubs/ir/2013/NIST.IR.7298r2.pdf NISTIR 7298 rev 2: Glossary of Key Information Security Terms, May 2013/FIPS 200]</ref>}}<br /> | {{definition|The level of impact on organizational operations (including mission,functions, image, or reputation), organizational [[Asset|assets]], or individuals resulting from the operation of an information system given the potential impact of a [[threat]] and the likelihood of that threat occurring. <ref name="NISTIR7298"> [http://nvlpubs.nist.gov/nistpubs/ir/2013/NIST.IR.7298r2.pdf NISTIR 7298 rev 2: Glossary of Key Information Security Terms, May 2013/FIPS 200]</ref>}}<br /> | ||
| − | + | {{definition|Risk is a measure of the extent to which an entity is threatened by a potential circumstance or [[event]], and typically a function of: (i) the adverse [[Impact|impacts]] that would arise if the circumstance or event occurs; and (ii) the likelihood of occurrence. <ref>[http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST Special Publication 800-53 Rev 4: Security and Privacy Controls for Federal Information Systems and Organizations (April 2013) / FIPS 200]</ref>}}<br/><br/> | |
| − | |||
=== Standard Definitions === | === Standard Definitions === | ||
Revision as of 23:44, 14 March 2016
Contents
Definitions
European Definitions
EU
The possibility of loss, damage or injury having regard to the value placed on the asset by its owner/operator and the impact of loss or change to the asset, and the likelihood that a specific vulnerability will be exploited by a particular threat. [1]
The probability of adverse effects caused by a hazardous phenomenon or substance in an organism, a population, or an ecological system. [2]
ENISA
Risk is the potential that a given threat will exploit vulnerabilities of an asset or group of assets and thereby cause harm to the organization (derived from ISO/IEC PDTR 13335-1). [3]
International Definitions
NATO CEP / EAPC
The level of risk is a condition of two factors: (1) the value placed on the asset by its owner/operator and the impact of loss or change to the asset, and (2) the likelihood that a specific vulnerability will be exploited by a particular threat.
UNISDR
National Definitions
Australia
The chance of something happening that will have an impact on objectives. It is measured in terms if likelihood and consequence. [6]
[7] provides three other Australian definitions of risk.
Brazil
Risco: efeito da incerteza nos objetivos. [8]
Risk is the uncertainty effect on goals.
Risk is the uncertainty effect on goals.
Canada
Risk is the combination of the likelihood and the consequence of a specified hazard being realized.
Combinaison de la possibilité qu’un aléa donné se produise et des conséquences potentielles pouvant y être associées. [9] [10]
Combinaison de la possibilité qu’un aléa donné se produise et des conséquences potentielles pouvant y être associées. [9] [10]
Risk refers to the vulnerability, proximity or exposure to hazards, which affects the likelihood of adverse impact.
Czech Republic
Riziko: (1) Nebezpečí, možnost škody, ztráty, nezdaru. (2) Účinek nejistoty na dosažení cílů. (3) Možnost, že určitá hrozba využije zranitelnosti aktiva nebo skupiny aktiv a způsobí organizaci škodu. [11]
Risk is either defined as: (1) Danger, possibility of damage, loss, failure. (2) Effect of uncertainty to achieve objectives. (3) Possibility that a certain threat would utilize vulnerability of an asset or group of assets and cause damage to an organization. [12]
Risk is either defined as: (1) Danger, possibility of damage, loss, failure. (2) Effect of uncertainty to achieve objectives. (3) Possibility that a certain threat would utilize vulnerability of an asset or group of assets and cause damage to an organization. [12]
Finland
Riski: kielteisen seikan tai tapahtuman todennäköisyyden ja vaikutusten yhdistelmä.
Risk is the combination of probability and consequences of a negative circumstance or event. -unofficial translation- [13]
Risk is the combination of probability and consequences of a negative circumstance or event. -unofficial translation- [13]
Germany
Likelihood of a serious danger which (a) constitutes a threat to human life, (b) will impair the health of a large number of people, or (c) affects economic activity, public services and technical infrastructures and may cause damage to the environment, in particular animals and plants, the soil, the water, the atmosphere and cultural and material assets. [14]
Greece
Κίνδυνος νοείται η πιθανότητα εκδήλωσης ενός φυσικού φαινομένου ή τεχνολογικού συμβάντος ή και λοιπών καταστροφών σε συνδυασμό με την ένταση των καταστροφών, που μπορεί να προκληθούν στους πολίτες, στα αγαθά, στις πλουτοπαραγωγικές πηγές και στις υποδομές μιας περιοχής.
(Risk is the combination of the occurrence likelihood of a natural hazard or a technological event or other disasters and the severity of the damages that can be caused to citizens, to assets, to productive sources and to infrastructures of a region) [15]
(Risk is the combination of the occurrence likelihood of a natural hazard or a technological event or other disasters and the severity of the damages that can be caused to citizens, to assets, to productive sources and to infrastructures of a region) [15]
India
Risk is the potential of damage to a system or associated assets that exists as a result of the combination of security threat and vulnerability. [16]
Ireland
Japan
リスク: 特定の脅威が特定の脆弱性を攻略し、特定の有害な結果をもたらす確率として表明される損失の期待値.
(Cyber) Risk is an expectation of loss expressed as the probability that a articular threat will exploit a particular vulnerability with a articular harmful result. [18]
(Cyber) Risk is an expectation of loss expressed as the probability that a articular threat will exploit a particular vulnerability with a articular harmful result. [18]
Netherlands
Risk is the annual loss expectancy (ALE) by the manifestation of threats.
Risico is de jaarlijks te verwachten schade door het manifesteren van bedreigingen. [19]
Risico is de jaarlijks te verwachten schade door het manifesteren van bedreigingen. [19]
Republic of Trinidad & Tobago
The combination of the probability of an event and its negative consequences. [20]
Switzerland
Das Risiko ist ein Mass für die Grösse einer Gefährdung und beinhaltet die Eintrittswahrscheinlichkeit und das Schadensausmass eines unerwünschten Ereignisses. [21]
Le « risque » permet de déterminer l’étendue d’une mise en danger et englobe la fréquence ou probabilité et l’ampleur des dommages d’un [[Incident}événement]] indésirable. [22]
Il rischio è un metro di misura per le dimensioni di una minaccia e implica la frequenza o la probabilità d’insorgenza e l'entità dei danni di un evento indesiderato. [23]
Le « risque » permet de déterminer l’étendue d’une mise en danger et englobe la fréquence ou probabilité et l’ampleur des dommages d’un [[Incident}événement]] indésirable. [22]
Il rischio è un metro di misura per le dimensioni di una minaccia e implica la frequenza o la probabilità d’insorgenza e l'entità dei danni di un evento indesiderato. [23]
Der Begriff Risiko dient beim Schutz kritischer Infrastrukturen als Modell sowohl zur Beurteilung von Sicherheitsfragen als auch zum Vergleich verschiedener Gefährdungen anhand gleicher Kriterien. Das Risikomodell beruht grundsätzlich auf zwei Faktoren:
- Eintrittswahrscheinlichkeit eines Ereignisses;
- Schadensausmass an Bevölkerung und deren Lebensgrundlagen.
Risiken lassen sich demzufolge als Produkt darstellen, das durch die Eintrittswahrscheinlichkeit eines Ereignisses und dessen Schadensausmasses bestimmt ist.
United Kingdom (UK)
Risk is a measure of the significance of a potential emergency in terms of its assessed likelihood and impact. [24]
United States
DHS
The potential for an unwanted outcome resulting from an incident, event, or occurrence, as determined by its likelihood and the associated consequences. [25]
NIST
The level of impact on organizational operations (including mission,functions, image, or reputation), organizational assets, or individuals resulting from the operation of an information system given the potential impact of a threat and the likelihood of that threat occurring. [26]
Risk is a measure of the extent to which an entity is threatened by a potential circumstance or event, and typically a function of: (i) the adverse impacts that would arise if the circumstance or event occurs; and (ii) the likelihood of occurrence. [27]
Standard Definitions
IETF
An expectation of loss expressed as the probability that a particular threat will exploit a particular vulnerability with a particular harmful result. [28]
ISO/IEC 27000:2014
- An effect is a deviation from the expected — positive or negative.
- Uncertainty is the state, even partial, of deficiency of information related to, understanding or * knowledge of, an event (2.25), its consequence, or likelihood.
- Risk is often characterized by reference to potential events and consequences, or a combination of these.
- Risk is often expressed in terms of a combination of the consequences of an event (including changes in circumstances) and the associated likelihood of occurrence.
- In the context of information security management systems, information security risks can be expressed as effect of uncertainty on information security objectives.
- Information security risk is associated with the potential that threats will exploit vulnerabilities of an information asset or group of information assets and thereby cause harm to an organization.
ISO/IEC 31000:2009
Effect of uncertainty on objectives. [31]
Other Definitions
Ontario (Canada)
Risk is the product of the probability of the occurrence of a hazard and its consequences. [32]
Risque: produit de la probabilité qu’un danger se produise et de ses conséquences. [32]
See also
Notes
- ↑ EC COM(2006) 787 final, Directive of the Council on the identification and designation of European Critical Infrastructure and the assessment of the need to improve their protection, EC, Brussels 12.12.2006.
- ↑ European Commission's CBRN Glossary, 2012
- ↑ ENISA Risk Glossary
- ↑ NATO EAPC(SCEPC) lexicon 2003.
- ↑ 2009 UNISDR Terminology on Disaster Risk Reduction, United Nations International Strategy for Disaster Reduction (UNISDR), Geneva, Switzerland, May 2009.
- ↑ Glossary of the Government of Queensland
- ↑ Australian Emergency Management Glossary, Emergency Management Australia (1998)
- ↑ GUIA DE REFERÊNCIA PARA A SEGURANÇA DAS INFRAESTRUTURAS CRÍTICAS DA INFORMAÇÃO Versão 01 (Nov. 2010)
- ↑ [http://www.publicsafety.gc.ca/cnt/rsrcs/pblctns/mrgnc-mngmnt-frmwrk/index-eng.aspx An Emergency Management Framework for Canada (Second Edition)
- ↑ Vocabulaire de la gestion des urgencies/Emergency Management Emergency Management Vocabulary 281 (2012)
- ↑ http://www.govcert.cz/download/nodeid-561 Výkladový slovník kybernetické bezpečnosti (2013)
- ↑ Act No. 181 of 23 July 2014 On Cyber Security and Change of Related Acts (Act on Cyber Security)
- ↑ Vocabulary of Comprehensive Security. Helsinki (TSK 47) (2014)
- ↑ http://www.kritis.bund.de/SharedDocs/Downloads/Kritis/EN/Baseline%20Protection%20Concept.pdf Protection of Critical Infrastructures – Baseline Protection Concept: Recommendation for Companies, BMI.
- ↑ General Civil Protection Plan "Xenocrates"(Γενικό σχέδιο Πολιτικής Προστασίας "Ξενοκράτης")
- ↑ India's DGQA Cyber Security Policy (2015)
- ↑ A FRAMEWORK FOR MAJOR EMERGENCY MANAGEMENT (APPENDICES)
- ↑ http://www.ipa.go.jp/security/rfc/RFC2828EN.html RFC2828 (Japanese translation)
- ↑ Zakboekje Preventie Cybercrime (2008)
- ↑ Comprehensive Disaster Management Policy Framework for Trinidad and Tobago
- ↑ Glossar der Risikobegriffe, Bundesamt für Bevölkerungsschutz BABS, 29.4.2013
- ↑ Glossaire des risques, Office fédéral de la protection de la population, 29.4.2013
- ↑ Glossario sui rischi, Ufficio federale della protezione della popolazione UFPP, 29.4.2013
- ↑ Glossary - Revision to Emergency Preparedness, Cabinet Office (2012)
- ↑ DHS Risk Lexicon 2010 Edition, September 2010
- ↑ NISTIR 7298 rev 2: Glossary of Key Information Security Terms, May 2013/FIPS 200
- ↑ NIST Special Publication 800-53 Rev 4: Security and Privacy Controls for Federal Information Systems and Organizations (April 2013) / FIPS 200
- ↑ IETF RFC449 Internet Security Glossary 2
- ↑ ISO/IEC 27000:2014, Information technology -- Security techniques -- Information security management systems -- Overview and vocabulary
- ↑ ISO Guide 73:2009 Risk management -- Vocabulary
- ↑ ISO/IEC 31000:2009, Risk management -- Principles and guidelines
- ↑ 32.0 32.1 Province of Ontario’s Emergency Management Glossary of Terms
