important step. Doing so is subject unto itself, but there are common components of risk equations that are helpful to understand. There are four fundamental forces involved in risk management, which also apply to cybersecurity. They are assets, impact, threats, and likelihood. You have internal knowledge of and a fair amount of control over assets, which are tangible and intangible things that have value. You also have some control over impact, which refers to loss of, or damage to, an asset. However, threats that represent adversaries and their methods of attack are external to your control. Likelihood is the wild card in the bunch. Likelihoods determine if and when a threat will materialize, succeed, and do damage. While never fully under your control, likelihoods can be shaped and influenced to manage the risk.Mathematically, the forces can be represented in a formula such as: where p() is the likelihood that a Threat will materialize/succeed against an Asset, and d() is the likelihood of various levels of damage that may occur. The field of IT risk management has spawned a number of terms and techniques which are unique to the industry. Some industry terms have yet to be reconciled. For example, the term vulnerability is often used interchangeably with likelihood of occurrence, which can be problematic. Often encountered IT risk management terms and techniques include: Information security event An identified occurrence of a system, service or network state indicating a possible breach of information security policy or failure of safeguards, or a previously unknown situation that may be security relevant. Occurrence of a particular set of circumstances The event can be certain or uncertain. The event can be a single occurrence or a series of occurrences. :(ISO/IEC Guide 73) Information security incident is indicated by a single or a series of unwanted information security events that have a significant probability of compromising business operations and threatening information security An event [G.11] that has been assessed as having an actual or potentially adverse effect on the security or performance of a system. Impact The result of an unwanted incident [G.17].(ISO/IEC PDTR 13335-1) Consequence Outcome of an event [G.11] There can be more than one consequence from one event. Consequences can range from positive to negative. Consequences can be expressed qualitatively or quantitatively (ISO/IEC Guide 73) The risk R is the product of the likelihood L of a security incident occurring times the impact