How to translate traditional risk assessment fields into PTA terms?
In a nutshell, the mapping of the traditional risk analysis fields to PTAs terms is as follows: Asset Value = Asset Value (annual) Exposure Factor = Threats Level of Damage to a specific Asset Single Loss Expectancy (SLE) = Threats Level of Damage to a specific Asset * Asset Value Annual Rate of Occurrence (ARO) = Threats Probability Annual Loss Expectancy (ALE) = Threats Risk (in $ or in percents of total assets value) For example: You have an asset of a computer that gets infected with a remote control virus. The exposure factor is 100% since the system must be rebuilt from scratch at the cost of 100$. The threat may happen 10 times a year. The capture of that threat in PTA is as follows: The Asset’s Value = 100$ The Threats Level of Damage to the specific Asset = 100% The Threats Probability = 10 times a year.
