Risk

Lesson plan

Level

Beginner

Time

About 60 minutes; the steps below add up to 58

Learners build the parts of a risk from a house before any term is used, including a house with a broken window and nothing inside, which shows that a weakness is not a risk on its own. The parts are then named and used to write a risk as a scenario sentence, which learners draft before seeing the lesson's. Predictions precede business context (one hour's outage, two systems), a second route to the same database, and the difference between a flaw nobody has found and one with an uninstalled fix. The habit to build: write a risk as a sentence, not the name of an asset.

Objectives

• Describe a risk as what could happen, how likely it is and how much it would matter to this organisation
• Tell assets, threats, vulnerabilities, incidents, impact and likelihood apart
• Write a risk as a scenario sentence, and see how changing one fact changes it
• Explain what the three common risk models show, and why they are not calculations
• Tell a zero-day from a known, unpatched vulnerability, and explain why it matters

Before the lesson

• Open this page on your own screen and use “Open the lesson window” to open the lesson in a second window. Share only that second window.
• Learners need the CIA Triad and GRC lessons first.
• Have somewhere to collect the house answers, ready to sort into five unlabelled groups in the second step.
• The lesson takes about 58 minutes.
• In presentation mode every step is shown in turns: Next reveals one moment, part or answer at a time, and the instructor view names what is on screen and what comes next.

Steps

1. Introduction Opening

   On screen: the lesson’s title, module and number; Next adds its objectives and key terms, as the lesson page lists them; Next again begins the first step.

   Objectives on screen

   • Describe a risk as what could happen, how likely it is and how much it would matter to this organisation
   • Tell assets, threats, vulnerabilities, incidents, impact and likelihood apart
   • Write a risk as a scenario sentence, and see how changing one fact changes it
   • Explain what the three common risk models show, and why they are not calculations
   • Tell a zero-day from a known, unpatched vulnerability, and explain why it matters

   Purpose: Learners build the parts of a risk from a house before any term is used, including a house with a broken window and nothing inside, which shows that a weakness is not a risk on its own. The parts are then named and used to write a risk as a scenario sentence, which learners draft before seeing the lesson's. Predictions precede business context (one hour's outage, two systems), a second route to the same database, and the difference between a flaw nobody has found and one with an uninstalled fix. The habit to build: write a risk as a sentence, not the name of an asset.

2. 1. A house in the street Think 6 min

   Purpose: Collect the parts of a risk from a familiar situation, and see that a weakness alone is not a risk.

   Ask

   • What would make a house more or less at risk of burglary?
   • Broken window, empty house: how much does the window matter?

   Responses to expect

   • “Valuables on show”, “an open window”, “a street with break-ins”, “a neighbour at home”.
   • Some say the window is always serious. Ask what a burglar could take.
   • On screen in turns: the opening question, its answer; then the question on an empty house, and its answer.

   Discussion pause: Collect the list before moving on; do not sort it yet.

   In the lesson window

   • Think it through: Think of a house. What would make it more at risk of being burgled, and what would make it less?
   • Think it through: A house has a window that does not lock. Nobody lives there and there is nothing inside worth taking. How much does the window matter?

3. 2. The idea Explain 5 min

   Purpose: Sort the learners' list into the five parts, and state what risk is.

   Ask

   • Which of your answers fit each of the five groups?

   Responses to expect

   • Most lists cover all five once sorted; likelihood and impact are the two most often merged.
   • On screen in turns: the opening; then the parts of a burglary risk, starting with something worth taking; someone who might take it; a way in; how likely it is; how much it would matter; take one part away; cybersecurity risk; the question an organisation asks.

4. 3. Assets, threats, vulnerabilities and business context Explain 9 min

   Purpose: Name the parts, apply them to an organisation, and see why the same event matters differently in different places.

   Ask

   • School laptops: which is the threat, the vulnerability and the asset?
   • An hour's outage on a test system and on hospital records: same risk?

   Responses to expect

   • The criminal group is often called the vulnerability; insist on “something that could cause harm” for a threat.
   • On screen in turns: the opening; then each part named, with the house held back; the house equivalent of each; the control; one risk, link by link; the diagram’s stages one at a time; the check question on which is the vulnerability, and its answer; the question on the same hour in different places, and its answer; business context; where the house comparison stops.

   Misconceptions to challenge

   • A learner may believe: “A vulnerability is a risk.” Respond: It is one ingredient; recall the empty house.

   Discussion pause: The house column is held back: ask the class to match each term to the burglary before revealing it. Then step through the chain one link at a time.

   In the lesson window

   • Check your understanding: A school’s laptops run an operating system that has not been updated for a year. A criminal group is known to target schools. Which is the vulnerability?
   • Think it through: One hour’s interruption hits two systems: a test system that developers try new features on, and a hospital’s patient records system. Is the risk the same?

5. 4. The customer-database scenario Experiment 5 min

   Purpose: Have learners write a risk as a scenario sentence before reading the lesson's.

   Ask

   • Turn the five rows into one sentence.

   Responses to expect

   • First attempts often just name the database. Ask: who, through what weakness, with what harm?
   • On screen in turns: the opening; then the question on writing it as a sentence, and its answer; the risk as a scenario; the questions that follow from it.

   In the lesson window

   • Think it through: Before reading on: turn the five rows of the table into one sentence that says what could happen and why it would matter.

6. 5. A fictional example Predict 6 min

   Purpose: Change one fact and see that one asset can carry several risks, each with its own likelihood and remedy.

   Ask

   • Same database, different way in: same risk?

   Responses to expect

   • Many say yes because the asset is the same. Ask whether one fix would stop both.
   • On screen in turns: the opening question, its answer; then changing one fact, starting with the new scenario; comparing the parts; comparing the likelihood; comparing what would help; what the comparison shows.

   Misconceptions to challenge

   • A learner may believe: “One asset has one risk.” Respond: Each route to it is a separate risk.

   If the explanation does not land: Return to the house: a burglar through the window, and a burglar with a copied key, need different fixes.

   In the lesson window

   • Think it through: Keep the same customer database, but imagine a different way in: an internet-facing web service that has not been updated. Is that the same risk as before?

7. 6. Three risk models Explain 7 min

   Purpose: Show what each risk model highlights, and that none is a calculation.

   Ask

   • Threat 4 × Vulnerability 3 × Asset 5 = 60. What does 60 mean?

   Responses to expect

   • Nothing measurable. Some will defend it; ask what the units are.
   • The “what it is not” column is held back: ask what each model might be mistaken for before revealing it.
   • On screen in turns: the opening; then three risk models, with what each is not held back; what each model is not; the empty house again; the check question on Threat × Vulnerability × Asset, and its answer; when numbers are multiplied, starting with a risk matrix; a quantitative model; the three models applied to one risk, starting with the three ingredients; impact and likelihood; what none of the models says.

   Misconceptions to challenge

   • A learner may believe: “The risk formulas are calculations.” Respond: They show what risk depends on; real numbers need a defined rating scheme or real units.

   In the lesson window

   • Check your understanding: A manager writes: “Threat 4 × Vulnerability 3 × Asset 5 = Risk 60.” What is wrong with this?

8. 7. Four distinctions that are easy to blur Explain 3 min

   Purpose: Consolidate four distinctions the later lessons rely on.

   Ask

   • Which of the four would you most likely mix up? Why?

   Responses to expect

   • Inherent and residual risk is the usual answer; it is developed in Treating Risk.
   • On screen in turns: the opening; then four distinctions, starting with threat and vulnerability; impact and likelihood; risk and technical severity; inherent and residual risk.

9. 8. Vulnerabilities and dependencies Predict 6 min

   Purpose: Separate flaws nobody has found from flaws with an uninstalled fix, and introduce dependencies.

   Ask

   • Two flaws: which can the school remove today?
   • A fix came out last month and has not been installed. Zero-day or not?

   Responses to expect

   • “Install updates for both” is common; ask whether an update can exist for an undiscovered flaw.
   • Many say zero-day. The maker knows and has a fix.
   • On screen in turns: the opening question, its answer; then two kinds of vulnerability, starting with the zero-day; the known, unpatched vulnerability; where no fix exists; the check question on a fix released last month, and its answer; suppliers and dependencies; turning a remark into an assessment.

   Misconceptions to challenge

   • A learner may believe: “Any unpatched vulnerability is a zero-day.” Respond: A zero-day is unknown to the maker; a flaw with a released fix is known and unpatched.

   In the lesson window

   • Think it through: A school uses two programs, each with a flaw. The maker of the first has not yet discovered its flaw. The maker of the second released a fix last week. Which flaw can the school remove today?
   • Check your understanding: The maker of a program released a fix for a flaw last month, but a school has not installed it yet. Is the flaw a zero-day vulnerability at the school?

10. 9. Apply it in a new situation Apply 4 min

    Purpose: Set up independent application, ideally on a later day.

    Ask

    • Who will try these now, and who later in the week?

    Responses to expect

    • The sports-club question checks writing a risk as a scenario; the council question checks likelihood.
    • On screen in turns: the opening; then the question on the sports club’s spreadsheet, and its answer; the question on a rare but catastrophic flood, and its answer.

    In the lesson window

    • Apply it: A sports club keeps its members’ contact details in a shared spreadsheet that anyone with the link can open. Which statement best describes the risk?
    • Apply it: A town council says: “A flood could destroy our records office, so flooding is our biggest risk.” The office is on a hill and has never flooded. What is missing from the council’s reasoning?

11. 10. Check your understanding Check 4 min

    Purpose: Check the lesson against the approved revision-bank questions.

    Ask

    • Answer individually, then compare before revealing.

    Responses to expect

    • The same-flaw question links back to the change-one-fact example.
    • On screen in turns: the opening; then the revision questions one at a time, each followed by its answer; where to practise next.

12. 11. What to remember Consolidate 3 min

    Purpose: Summarise the five points, the key terms and the misunderstandings, and point to Assessing Risk.

    Ask

    • Without looking: write one risk as a scenario sentence.

    Responses to expect

    • Threat, vulnerability, asset and impact in one sentence.
    • On screen in turns: the opening; then the summary; the key terms; the common misunderstandings.

13. Lesson recap Closing

    On screen: the lesson’s objectives again; Next adds the closing question, which asks the class to explain each one in their own words without looking back. It says nothing about what anyone has learnt: use the answers to decide what to revisit.

    Points to listen for

    • A risk is a scenario: what, to what, through which weakness, how likely, how much it matters.
    • Remove a threat, a weakness or the asset, and that particular risk disappears.
    • Different routes to one asset are different risks.
    • The risk models describe dependence; they do not calculate.
    • Known and unpatched is not the same as zero-day.

Consolidation

• A risk is a scenario: what, to what, through which weakness, how likely, how much it matters.
• Remove a threat, a weakness or the asset, and that particular risk disappears.
• Different routes to one asset are different risks.
• The risk models describe dependence; they do not calculate.
• Known and unpatched is not the same as zero-day.