Lion Cipher Lab
Conduct a risk assessment the NIST SP 800-30 way, end to end
- GRC / Compliance
- Advanced
- ~90 min
- Free · no account required
Why it matters
Almost every framework tells you to 'assess your risk' and then waves at the how. NIST SP 800-30 Rev 1 is the how: the concrete, repeatable process the U.S. federal risk world actually uses to turn a fuzzy worry into a rated, prioritized, defensible list. Learning it matters for two reasons. First, it is the risk-assessment engine that feeds the Risk Management Framework -- the ratings you produce here are what tell an authorizing official which risks to accept, which controls to select next, and what to watch in continuous monitoring. Second, and more importantly, 800-30 forces a discipline…
What you'll learn
- running the full NIST SP 800-30 Rev 1 process end to end -- frame, then identify sources / events / vulnerabilities, then determine likelihood, impact, and risk
- distinguishing an 800-30 risk assessment (threat-event driven, qualitative) from an 800-53A CONTROL assessment and from FAIR's quantitative loss modeling
- characterizing threat sources by capability, intent, and targeting (adversarial) vs range of effects (non-adversarial) using the 800-30 taxonomies in Appendix D
- deriving threat events from Appendix E and mapping them to MITRE ATT&CK techniques so ratings rest on real adversary behavior instead of guesswork
- separating likelihood of initiation/occurrence from likelihood of resulting in adverse impact, and combining them into an overall likelihood (Appendix G)
- assigning impact on an organizational-harm scale (Appendix H) and computing risk = likelihood x impact via the Table I-2 risk matrix (Appendix I)
- producing a prioritized, defensible risk register / risk-assessment report that feeds RMF Select, Authorize, and continuous monitoring
- spotting and avoiding the classic failure modes: rating everything High, conflating the two likelihoods, and ignoring predisposing conditions
Steps in this lab
- What 800-30 is -- and the two things it is NOT
- Task 1 -- FRAME the assessment (purpose, scope, assumptions, model)
- Build the risk-register skeleton (your deliverable)
- Task 2, Step 1 -- identify THREAT SOURCES (Appendix D)
- Task 2, Step 2 -- identify THREAT EVENTS (Appendix E) and map to ATT&CK
- Task 2, Step 3 -- identify VULNERABILITIES and predisposing conditions (Appendix F)
- Task 2, Step 4 -- determine LIKELIHOOD (the two-factor method, Appendix G)
- Task 2, Step 5 -- determine IMPACT (Appendix H)
- Task 2, Step 6 -- determine RISK and prioritize (Table I-2)
- Communicate the results and feed the RMF (800-37 / 800-39)
- The judgment: scales, failure modes, and the do-it-better move