NETS 1015:

SECURITY
MANAGEMENT

Lecture #7

TVA and Ranked Vulnerability

Worksheets
 These 2 worksheets discussed in this
lecture serve a valuable purpose in
per forming a Risk Assessment.

Why do we The TVA helps organize and identify

currently known assets and

have to do threats /vulnerabilities.

The Ranked Vulnerability Risk Worksheet

this? will help to identify and organize which

combination of assets and vulnerabilities
are a priority to have protections put in
place.
What is a A Threats-Vulnerabilities-Asset (TVA) worksheet is
completed as one of the last steps involved in

Threats-
preparing to engage in a full Risk Assessment
process.

Vulnerabilities- After having collected a list of assets and

threats/vulnerabilities posed to an organization you

Asset
then combine them into a TVA.

The TVA will show intersections between assets and

Worksheet? the vulnerabilities.

 On a TVA worksheet the information is
presented in the following format:

• A prioritized list of assets aligned along 1

axis (most critical /impor tant assets fi rst)

The layout • A prioritized list of threats (most severe)

• Once completed you will list the current

of a TVA controls (mitigations) with a
corresponding colour.
worksheet • The worksheet is then viewed as a
possible intersection of assets and their
threats, layered with colours to indicate if
there is a current control (see example on
next slide)
TVA
Worksheet
Example
 • The purpose behind the TVA is to help
identify TVA “triples”.

• A triple is when assets intersect

multiple threats or when a threat
intersects multiple assets.
Understanding • This will help to discover the severity of
a vulnerability/threat.
the TVA • Risk relationships can be ‘often’
summarized in the equation
Risk= F(t, v, a)

(Risk is a function of threat,

vulnerability, and asset)
 T h i s w o r k s h e e t i s d o n e a s t h e fi n a l ‘a c t i v i t y ’ b e fo r e
m ov i n g o n t o d ra w i n g u p a f u l l R i s k As s e s s m e n t .

I t s e r ve s t o s u m m a r i ze i n fo r m a t i o n a l re a d y
gathered and to help identify current gaps and
The Ranked weaknesses.

Vulnerability T h e c o l u m n s o n t h e w o r k s h e e t a r e a s fo l l o w s :

• As s e t : L i s t o f e a c h v u l n e ra b l e a s s e t

Risk • As s e t Im p a c t : S h o w t h e r e s u l t s fo r t h i s a s s e t
f r o m t h e p r e v i o u s a n a l y s i s ( i e va l u e 1 t o 1 0 0 )

Worksheet •

•
Vu l n e ra b i l i t y : L i s t e a c h v u l n e ra b i l i t y.

Vu l n e ra b i l i t y L i ke l i h o o d : S t a t e t h e l i ke l i h o o d t h a t
they will occur (ie 0.1 to1.0)

• R i s k : t h e c a l c u l a t i o n o f i m p a c t t i m e l i ke l i h o o d .
The
Worksheet