...

Outcome: the Create New Profile dialog will open.

...

Basic Data

Choose a suitable name; a description is optional. As soon as several profiles exist, each of these will be available for use as a template. Select if you wish to have the system calculate a single impact value (checkbox Aggregate impact). When done, click Create.

...

On the Basic Data screen, we stipulate that you accept your previous entries and navigate to the Impact Rating screen.

...

Impact Rating

...

The screen identifies your current profile and template, as well as your setting for Single Risk Value. The 'X' denotes that the parameter is deselected, meaning that the system will determine individual impact values for each Category.

...

The four predefined categories cannot be deleted. Clicking the ‘plus’ icon, to contrast, will add a new category with an active ‘trash’ icon to visualize the fact that such a category may be deleted.

...

Attack Feasibility

This screen serves a similar purpose to Impact Rating but has a different structure. Instead of the normative four degrees (Negligible..Severe) used to rate impacts, Attack Feasibility parameters may have various levels.

...

It is further possible to switch from the Attack Potential Based Approach to CVSS Exploitability Metrics. CVSS uses different parameters and includes a mapping constant, which is also amenable to user-side editing.

...

Risk Evaluation

The rationale here is aimed at evaluating risks by processing impacts and attack feasibilities. The table shown reflects this method. It is possible to define the cellular values individually, within the normative 1..5 scope.

...

Switch across impact categories using the drop-down provided.

...

CAL (Cybersecurity Assurance Level)

The CAL value is also calculated based on matrix inputs, based on threat scenarios. Of all damage scenarios associated with a threat scenario, the highest impact will be relevant for the calculation.

...