Replacing Likelihood With Credibility In The Risk Equation

### Overview In this presentation, Andrew (from Waterfall Security Solutions) challenges the universal reliance on the classic risk formula (`Risk = Impact × Likelihood`), particularly when applied to high-consequence, industrial, and safety-critical environments. He argues that the term "likelihood" improperly implies objective probability and randomness, which misleads practitioners and decision-makers when confronting sophisticated, deterministic, and persistent cyber threats. Instead, he proposes restructuring risk guidance (specifically standards like IEC 62443-3-2 and NIST SP 800-30) by substituting "frequency" for low-impact scenarios and replacing "likelihood" with "credibility" when evaluating high-impact risks.

### Key Topics - **Flaws of Likelihood in Risk Equations:** Likelihood equates cyber incidents to random hardware failures or roll-of-the-dice events. However, sophisticated cyber threats are goal-oriented, persistent, and overcome early-stage randomness with repetition, making their outcomes deterministic design failures rather than random events. - **Low Impact vs. High Consequence:** For low-impact incidents (e.g., commodity malware, phishing clicks), the formula can be repaired by replacing likelihood with frequency (`Risk = Impact × Frequency`), yielding a measurable rate such as dollars per unit time. For high-consequence incidents (e.g., power grid collapse, train collisions, safety boiler explosions), the formula breaks down and should be discarded. - **Legal Due Care and Reasonableness:** In safety-critical sectors, legal accountability hinges on "due care"—whether the practitioner did what any reasonable person skilled in the art would do. Translating this legal requirement into risk management leads to defining "credibility" as what is reasonable to believe about threat scenarios. - **The Design Basis Threat (DBT) Line:** Rather than applying qualitative likelihood rankings to high-impact threats, engineering organizations partition threats into those defeated with high confidence versus those that are not, assessing what credible threats remain above the design line.

### Technical Details - **Standards Under Review:** References standard risk frameworks including IEC 62443-3-2 and NIST SP 800-30. The speaker notes that both mention non-probabilistic or subjective judgment in fine print (e.g., NIST SP 800-30 footnote 55 and IEC 62443 glossary notes), yet both use likelihood unqualified throughout the body text. - **Spanish Rail Case Study:** A graduate exercise run by Jesús Molina at the University of Barcelona showed practicing rail engineers universally assigning Security Level 4 (SL4) to high-impact scenarios regardless of likelihood, aligning with Spanish safety laws requiring the strongest practical protections when lives are at risk. - **Bridge Engineering Analogy:** Drawing parallels to civil engineering and cyber-informed engineering, high-impact defense should not rely on "hope" (detecting attacks in progress and scrambling incident response), but rather on engineering-grade protections—such as mechanical overpressure relief valves, manual fallbacks, and unidirectional security gateways—with large margins of safety to carry a specified threat load.

### Takeaways - For low-consequence scenarios, adjust the formula to `Impact × Frequency` to maintain sensible mathematical units. - For high-impact, critical infrastructure, and physical safety decisions, eliminate the classic formula. Update risk terminology in standards revisions (such as IEC 62443-3-2) to focus on "credibility." - Treat high-consequence industrial cybersecurity like safety engineering: establish a Design Basis Threat, design systems to handle a specified threat load with significant safety margins, and evaluate whether defensive choices pass legal and peer reasonableness tests (e.g., the "pub test").