Risk Value
The risk value is the result of risk value determination under ISO/SAE 21434. Each threat scenario gets its own, determined from the impact of the associated damage scenarios and the attack feasibility of the associated attack paths. It lies between 1 and 5; 1 stands for minimal risk. In itemis SECURE, the same quantity is called risk level (RL).
Matrix or formula
The standard leaves open how the two inputs become one number. It names risk matrices and risk formulas as examples, and Annex H shows both. The example matrix looks like this:
| Impact \ Feasibility | Very low | Low | Medium | High |
|---|---|---|---|---|
| Severe | 2 | 3 | 4 | 5 |
| Major | 1 | 2 | 3 | 4 |
| Moderate | 1 | 2 | 2 | 3 |
| Negligible | 1 | 1 | 1 | 1 |
As a formula, Annex H suggests R = 1 + I × F, with numerical values from 0 to 2 for impact and feasibility. For the two scenarios in the example, the result is the same as with the matrix. The standard claims no more than that. In other cells the results differ: severe at very low gives 1 with the formula and 2 in the matrix.
What the matrix decides
The negligible row has a 1 everywhere. Where the damage is negligible, the attack side no longer changes anything. In the severe row, the value never drops below 2. A severe damage therefore never lands at the minimum, however much effort the attack takes. And in the moderate row, low and medium both have a 2. A measure that pushes a path from medium to low doesn’t change the risk value there.
That is why the organization should define the matrix once instead of leaving it to each project. Anyone who adapts it per TARA ends up with risk values that look the same but mean different things.
Several paths, several damage scenarios
If a scenario has several attack paths, you may aggregate their ratings, in the standard’s example via the maximum. If it is linked to several damage scenarios or impact categories, it may get a separate risk value for each impact rating. That is why Annex H writes “S: 5” for spoofing the lamp request: the easiest path, via the cellular interface, is rated high, and the damage in the safety category is severe.
What comes next
The risk value is the basis of risk treatment. The standard names no threshold above which a risk must be reduced. The number is an argument. Someone still has to make the decision. Our articles on asset identification and impact rating and on threat scenarios and attack paths describe how impact and feasibility come about.