Rapid Risk Assessment: A Lightweight Approach
summary
A lightweight Rapid Risk Assessment (RRA) method developed at Mozilla in 2013 condenses threat modeling into a one‑hour review with four phases: information gathering, a data dictionary, CIA‑based threat scenarios, and prioritized recommendations. Uses an impact scale (low <$100k, critical >$10M) and a company‑level data classification; recommendation for the example file‑sharing app is client‑side AES‑GCM‑256 with the key in the URL anchor to cover confidentiality and integrity. Hundreds of RRAs feed a central risk register for ongoing prioritization.
AI-written summary · about
chapters (5)
- 0:00Introduction to Rapid Risk Assessment
- 10:11Information gathering phase
- 17:36Threat modeling with CIA triad
- 28:59Making security recommendations
- 32:07Risk register and next steps
related talks
43mRDI: A Free and Easy Framework for Ransomware Readiness Assessment
36mNot Your Mama's Risk Assessment
55mArchitectural Risk Assessments
30mFireproof Your Castle with Risk-First GRC
26mSimple Method of Automatic Risks Assessment for Web Systems Considering Assets Sensitivity
42mSecurity Threat Modeling Live from Scratch Session
15mRAIL: Risk-Aware Human-in-the-Loop Framework with Adaptive Intrusion Response...
53mEnterprise Application Risk Profiling