Information Security Formulas

Three formula types, one per scoring tier. This is the only risk module with three rather than two, because the impact of a security risk is itself computed before it meets the probability.

The three types

Type	Produces	May reference
Impact score	[IS]	[IC] [II] [IA]
Risk score	[RS]	[IS] [P] [AV]
Risk value	The band number	[IC] [II] [IA] [P] [IS] [RS]

Token	Is
[IC] [II] [IA]	The three impact weights
[P]	The probability weight
[IS]	The impact score's output
[RS]	The risk score's output
[AV]	The asset value from the risk's asset link

The restriction runs one way. A band may read every tier beneath it. A score expression may not name the output it exists to produce — and that is refused when the formula is saved, rather than left to fail against a record that happens to exercise it.

Fields

• Code / Name — the formula's identity.

• Formula type — impact score, risk score or risk value. Set this first; it decides which tokens the editor accepts.

• Expression — the expression itself.

• Blank value default
  What an unanswered variable is worth. Empty (the default) means the formula refuses to score while any variable it names has no value. See Blank value default below.

• Active — one active formula per tier. Activating one stands the previous one of that tier down.

The shipped formulas

Six formulas, two per tier, of which the first of each is active:

Code	Name	Tier	Expression	Active
BFM00001	Standard Impact Score	Impact	MAX([IC]:[II]:[IA])	Yes
BFM00002	Standard Risk Score	Risk score	[IS]*[P]	Yes
BFM00003	Standard Risk Value	Band	IF([RS]>=15:4:IF([RS]>=10:3:IF([RS]>=5:2:1)))	Yes
BFM00004	Multiplicative Impact Score	Impact	[IC]*[II]*[IA]	No
BFM00005	Asset Valued Risk Score	Risk score	[IS]*[P]*[AV]	No
BFM00006	Asset Valued Risk Value	Band	IF([RS]>=180:4:IF([RS]>=60:3:IF([RS]>=20:2:1)))	No

The active three are the standard chain: the impact is the worst of the three dimensions, the risk score is impact times probability for a 1–25 range, and the bands are cut at 5, 10 and 15 to match.

The inactive three are alternatives you may switch to — a multiplicative impact, and the asset-valued pair that multiplies in the asset's own value.

caution

The three tiers are activated independently, and nothing pairs them.

Activate BFM00004 — the multiplicative impact, range 1 to 125 — while leaving the standard band thresholds at 5, 10 and 15, and nearly every risk will band as Critical. There is no error and no warning at scoring time; the register simply reads as though everything were on fire.

BFM00005 and BFM00006 are a matched set. Activate one and you must activate the other, or the same failure happens in reverse.

The formula screen carries this warning in its help text.

A tier with no active formula falls back to manual entry

If no formula is active for a tier, the person scoring types that number by hand. This is a legitimate configuration — an organization that assigns impact scores by committee rather than by arithmetic can leave the impact tier without a formula.

The asset value token

[AV] comes from the risk's asset link, and it exists only where the link goes through the Asset Risk module.

Two consequences:

• The token is not offered where Asset Risk is not installed. Offering it would let somebody write a formula that fails on every record.
• A risk score formula that names it narrows the risk form. The link types that cannot supply an asset value — the direct asset link, and linking nothing at all — are withdrawn.

note

The token is filtered from the palette, not removed from the vocabulary. The same installation may gain Asset Risk later, and the token has to come back — along with the formulas that were written using it.

Writing expressions

Expressions use spreadsheet syntax. Both IF(a:b:c) and IF(a,b,c) are accepted, and the usual functions are available: MAX, MIN, SUM, AVERAGE, ROUND and their relatives.

Tokens are bracketed so that the F inside IF( cannot be read as a variable.

Examples

An impact score that weights confidentiality highest:

MAX([IC]*1.5 : [II] : [IA])

A band that forces Critical whenever confidentiality impact is at its maximum, whatever the score:

IF([IC]>=5 : 4 : IF([RS]>=15 : 4 : IF([RS]>=10 : 3 : IF([RS]>=5 : 2 : 1))))

That second example is why a band may read the tiers beneath it. Forcing the top band from a single dimension at its highest level is a common requirement, and it cannot be expressed from the risk score alone.

Your own fields as variables

Any parametric field you have defined on the record this formula scores can be named in an expression, in brackets, exactly like the built-in variables:

[IS]*[P]*[business_criticality]

Which of your fields are eligible:

Field type	Usable in a formula
Number, Decimal	Yes
Yes / No	Yes — counts as 1 or 0
Single select	Only if every option's value is a number or a yes/no
Everything else — text, dates, files, references, multi-select	No

A select over labels is a category, and multiplying by a category means nothing however tidy the arithmetic looks. The formula editor's palette lists the eligible fields beside the built-in variables, so you do not have to remember the key.

The score shown live on the assessment screen is worked out from the same fields as the stored score, so what you see while filling the form is what gets saved. See Parametric Fields for how to define one.

Blank value default

A blank field is not zero. By default, a formula that names a field with no value refuses to score at all, and the record keeps whatever it had. That is deliberate: an empty cell would evaluate as nought, and a score of nought reads as no risk rather than not answered yet.

That default is right when every variable is compulsory, and wrong when a parametric field is genuinely optional. So each formula carries its own setting:

• Blank value default — empty (the default)
  Refuse to score while any referenced variable has no value.

• Blank value default — a number
  Every unsupplied variable evaluates as that number. Set it to 1 for a multiplier that should have no effect when unanswered, or 0 for an addend.

One number applies to all of that formula's variables; it is not set per field. Zero is a legitimate choice — leaving the setting empty is what means "no default", not entering 0.

caution

Before setting a blank value default, be sure the answer it produces is one you would defend. "Treat blanks as 1" quietly turns an unanswered exposure factor into a full-weight one.

The formula editor

The expression is edited on a full page rather than in a modal, because the editor carries three things:

• A token palette of the variables this tier may use, following the formula type field. Switching the type re-reads what may be named.
• A live check that validates the expression as you type. A refusal mid-typing is expected, not an error.
• A try-it panel that evaluates the expression against values you supply — and for a band formula reports which band the result lands on, or warns that no band declares that number.

tip

Test the whole chain, not one tier at a time. Enter the maximum of all four scored inputs and confirm the band; enter the minimum and confirm it too. With three tiers, a mismatch between tier two's range and tier three's thresholds is the failure mode — and it is invisible until you walk a value through all three.

Import and export

Formula definitions export to Excel and re-load from a filled-in template. The expression is checked on the way in exactly as on the form, so an expression the editor refuses cannot be stored by uploading it instead.