KEMBAR78
Cryptography | PDF | Key (Cryptography) | Cryptography
0% found this document useful (0 votes)
31 views17 pages

Cryptography

Cryptography is a method of securing communication by converting plain text into ciphertext using algorithms to ensure data confidentiality, integrity, authentication, and non-repudiation. It includes various types such as symmetric key cryptography, hash functions, and asymmetric key cryptography, each with distinct applications like secure web browsing, digital currencies, and electronic signatures. The Advanced Encryption Standard (AES) is a widely used encryption algorithm that provides strong data protection through block cipher techniques.

Uploaded by

Vinuta Hiremath
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
0% found this document useful (0 votes)
31 views17 pages

Cryptography

Cryptography is a method of securing communication by converting plain text into ciphertext using algorithms to ensure data confidentiality, integrity, authentication, and non-repudiation. It includes various types such as symmetric key cryptography, hash functions, and asymmetric key cryptography, each with distinct applications like secure web browsing, digital currencies, and electronic signatures. The Advanced Encryption Standard (AES) is a widely used encryption algorithm that provides strong data protection through block cipher techniques.

Uploaded by

Vinuta Hiremath
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
You are on page 1/ 17

Cryptography is a technique of securing communication by converting plain

text into ciphertext. It involves various algorithms and protocols to ensure


data confidentiality, integrity, authentication, and non-repudiation. In this
article, we will discuss cryptography and its types.
What is Cryptography?
Cryptography is a technique of securing information and communications
through the use of codes so that only those persons for whom the
information is intended can understand and process it. Thus preventing
unauthorized access to information. The prefix “crypt” means “hidden” and
the suffix “graphy” means “writing”. In Cryptography, the techniques that are
used to protect information are obtained from mathematical concepts and a
set of rule-based calculations known as algorithms to convert messages in
ways that make it hard to decode them. These algorithms are used for
cryptographic key generation, digital signing, and verification to protect data
privacy, web browsing on the internet and to protect confidential transactions
such as credit card and debit card transactions.

Features Of Cryptography
 Confidentiality: Information can only be accessed by the person for whom
it is intended and no other person except him can access it.
 Integrity: Information cannot be modified in storage or transition between
sender and intended receiver without any addition to information being
detected.
 Non-repudiation: The creator/sender of information cannot deny his
intention to send information at a later stage.
 Authentication: The identities of the sender and receiver are confirmed. As
well destination/origin of the information is confirmed.
 Interoperability: Cryptography allows for secure communication between
different systems and platforms.
 Adaptability: Cryptography continuously evolves to stay ahead of security
threats and technological advancements.

Cryptography secures communication by encrypting data. If you’re studying


security protocols, the GATE CS Self-Paced Course offers in-depth learning.
Types Of Cryptography
1. Symmetric Key Cryptography
It is an encryption system where the sender and receiver of a message use a
single common key to encrypt and decrypt messages. Symmetric Key
cryptography is faster and simpler but the problem is that the sender and
receiver have to somehow exchange keys securely. The most popular
symmetric key cryptography systems are Data Encryption Systems
(DES) and Advanced Encryption Systems (AES) .

Symmetric Key Cryptography

2. Hash Functions
There is no usage of any key in this algorithm. A hash value with a fixed
length is calculated as per the plain text which makes it impossible for the
contents of plain text to be recovered. Many operating systems use hash
functions to encrypt passwords.
3. Asymmetric Key Cryptography
In Asymmetric Key Cryptography, a pair of keys is used to encrypt and
decrypt information. A receiver’s public key is used for encryption and a
receiver’s private key is used for decryption. Public keys and Private keys
are different. Even if the public key is known by everyone the intended
receiver can only decode it because he alone knows his private key. The
most popular asymmetric key cryptography algorithm is the RSA algorithm.

Asymmetric Key Cryptography

Applications of Cryptography
 Computer passwords: Cryptography is widely utilized in computer security,
particularly when creating and maintaining passwords. When a user logs
in, their password is hashed and compared to the hash that was
previously stored. Passwords are hashed and encrypted before being
stored. In this technique, the passwords are encrypted so that even if a
hacker gains access to the password database, they cannot read the
passwords.
 Digital Currencies: To protect transactions and prevent fraud, digital
currencies like Bitcoin also use cryptography. Complex algorithms and
cryptographic keys are used to safeguard transactions, making it nearly
hard to tamper with or forge the transactions.
 Secure web browsing: Online browsing security is provided by the use of
cryptography, which shields users from eavesdropping and man-in-the-
middle assaults. Public key cryptography is used by the Secure Sockets
Layer (SSL) and Transport Layer Security (TLS) protocols to encrypt data
sent between the web server and the client, establishing a secure channel
for communication.
 Electronic signatures: Electronic signatures serve as the digital equivalent
of a handwritten signature and are used to sign documents. Digital
signatures are created using cryptography and can be validated using
public key cryptography. In many nations, electronic signatures are
enforceable by law, and their use is expanding quickly.
 Authentication: Cryptography is used for authentication in many different
situations, such as when accessing a bank account, logging into a
computer, or using a secure network. Cryptographic methods are
employed by authentication protocols to confirm the user’s identity and
confirm that they have the required access rights to the resource.
 Cryptocurrencies: Cryptography is heavily used by cryptocurrencies like
Bitcoin and Ethereum to protect transactions, thwart fraud, and maintain
the network’s integrity. Complex algorithms and cryptographic keys are
used to safeguard transactions, making it nearly hard to tamper with or
forge the transactions.
 End-to-end Internet Encryption: End-to-end encryption is used to protect
two-way communications like video conversations, instant messages, and
email. Even if the message is encrypted, it assures that only the intended
receivers can read the message. End-to-end encryption is widely used in
communication apps like WhatsApp and Signal, and it provides a high
level of security and privacy for users.
Advantages of Cryptography
 Access Control: Cryptography can be used for access control to ensure
that only parties with the proper permissions have access to a resource.
Only those with the correct decryption key can access the resource
thanks to encryption.
 Secure Communication: For secure online communication, cryptography is
crucial. It offers secure mechanisms for transmitting private information
like passwords, bank account numbers, and other sensitive data over the
Internet.
 Protection against attacks: Cryptography aids in the defense against
various types of assaults, including replay and man-in-the-middle attacks .
It offers strategies for spotting and stopping these assaults.
 Compliance with legal requirements: Cryptography can assist firms in
meeting a variety of legal requirements, including data protection and
privacy legislation.
Advanced Encryption Standard (AES)
Last Updated : 16 Jul, 2024



Advanced Encryption Standard (AES) is a specification for the


encryption of electronic data established by the U.S. National
Institute of Standards and Technology (NIST) in 2001. AES is widely
used today as it is much stronger than DES and triple DES despite
being harder to implement. In this article, we will cover the AES, the
Working of Cipher and Encryption-Decryption methods used in it,
and its applications.
What is Advanced Encryption Standard
(AES)?
Advanced Encryption Standard (AES) is a highly trusted encryption
algorithm used to secure data by converting it into an unreadable
format without the proper key. Developed by the National Institute
of Standards and Technology (NIST), AES encryption uses
various key lengths (128, 192, or 256 bits) to provide strong
protection against unauthorized access. This data
security measure is efficient and widely implemented in
securing internet communication, protecting sensitive data,
and encrypting files. AES, a cornerstone of modern cryptography, is
recognized globally for its ability to keep information safe from
cyber threats.
Points to Remember
 AES is a Block Cipher.
 The key size can be 128/192/256 bits.
 Encrypts data in blocks of 128 bits each.
That means it takes 128 bits as input and outputs 128 bits of
encrypted cipher text. AES relies on the substitution-permutation
network principle, which is performed using a series of linked
operations that involve replacing and shuffling the input data.
Working of The Cipher
AES performs operations on bytes of data rather than in bits. Since
the block size is 128 bits, the cipher processes 128 bits (or 16 bytes)
of the input data at a time.
The number of rounds depends on the key length as follows :
 128-bit key – 10 rounds
 192-bit key – 12 rounds
 256-bit key – 14 rounds
Creation of Round Keys
A Key Schedule algorithm calculates all the round keys from the key.
So the initial key is used to create many different round keys which
will be used in the corresponding round of the encryption.

Creation of Round Keys (AES)


Encryption
AES considers each block as a 16-byte (4 byte x 4 byte = 128 ) grid
in a column-major arrangement.
[ b0 | b4 | b8 | b12 |
| b1 | b5 | b9 | b13 |
| b2 | b6 | b10| b14 |
| b3 | b7 | b11| b15 ]
Each round comprises of 4 steps :
 SubBytes
 ShiftRows
 MixColumns
 Add Round Key
The last round doesn’t have the MixColumns round.
The SubBytes does the substitution and ShiftRows and MixColumns
perform the permutation in the algorithm.
Sub Bytes
This step implements the substitution.
In this step, each byte is substituted by another byte. It is performed
using a lookup table also called the S-box. This substitution is done
in a way that a byte is never substituted by itself and also not
substituted by another byte which is a compliment of the current
byte. The result of this step is a 16-byte (4 x 4 ) matrix like before.
The next two steps implement the permutation.
Shift Rows
This step is just as it sounds. Each row is shifted a particular number
of times.
 The first row is not shifted
 The second row is shifted once to the left.
 The third row is shifted twice to the left.
 The fourth row is shifted thrice to the left.
(A left circular shift is performed.)
[ b0 | b1 | b2 | b3 ] [ b0 | b1 | b2 | b3 ]
| b4 | b5 | b6 | b7 | -> | b5 | b6 | b7 | b4 |
| b8 | b9 | b10 | b11 | | b10 | b11 | b8 | b9 |
[ b12 | b13 | b14 | b15 ] [ b15 | b12 | b13 | b14 ]
Mix Columns
This step is a matrix multiplication. Each column is multiplied with a
specific matrix and thus the position of each byte in the column is
changed as a result.
This step is skipped in the last round.
[ c0 ] [ 2 3 1 1 ] [ b0 ]
| c1 | = | 1 2 3 1 | | b1 |
| c2 | | 1 1 2 3 | | b2 |
[ c3 ] [ 3 1 1 2 ] [ b3 ]
Add Round Keys
Now the resultant output of the previous stage is XOR-ed with the
corresponding round key. Here, the 16 bytes are not considered as a
grid but just as 128 bits of data.

Added Round Keys (AES)

After all these rounds 128 bits of encrypted data are given back as
output. This process is repeated until all the data to be encrypted
undergoes this process.
Decryption
The stages in the rounds can be easily undone as these stages have
an opposite to it which when performed reverts the changes. Each
128 blocks goes through the 10,12 or 14 rounds depending on the
key size.
The stages of each round of decryption are as follows :
 Add round key
 Inverse MixColumns
 ShiftRows
 Inverse SubByte
The decryption process is the encryption process done in reverse so
I will explain the steps with notable differences.
Inverse MixColumns
This step is similar to the Mix Columns step in encryption but differs
in the matrix used to carry out the operation.
Mix Columns Operation each column is mixed independent of the
other.
Matrix multiplication is used. The output of this step is the matrix
multiplication of the old values and a
constant matrix
[b0] = [ 14 11 13 9] [ c0 ]
[b1]=[ 9 14 11 13 ] [ c1 ]
[b2] =[ 13 9 14 11] [ c2 ]
[ b3 ]=[ 11 13 9 14 ] [ c3 ]
Inverse SubBytes
Inverse S-box is used as a lookup table and using which the bytes
are substituted during decryption.
Function Substitute performs a byte substitution on each byte of the
input word. For this purpose,
it uses an S-box.
Applications
AES is widely used in many applications which require secure data
storage and transmission. Some common use cases include:
 Wireless security: AES is used in securing wireless networks,
such as Wi-Fi networks, to ensure data confidentiality and prevent
unauthorized access.
 Database Encryption: AES can be applied to encrypt sensitive
data stored in databases. This helps protect personal information,
financial records, and other confidential data from unauthorized
access in case of a data breach.
 Secure communications: AES is widely used in protocols such
as internet communications, email, instant messaging, and
voice/video calls. It ensures that the data remains confidential.
 Data storage: AES is used to encrypt sensitive data stored on
hard drives, USB drives, and other storage media, protecting it
from unauthorized access in case of loss or theft.
 Virtual Private Networks (VPNs): AES is commonly used in
VPN protocols to secure the communication between a user’s
device and a remote server. It ensures that data sent and
received through the VPN remains private and cannot be
deciphered by eavesdroppers.
 Secure Storage of Passwords: AES encryption is commonly
employed to store passwords securely. Instead of storing
plaintext passwords, the encrypted version is stored. This adds an
extra layer of security and protects user credentials in case of
unauthorized access to the storage.
 File and Disk Encryption: AES is used to encrypt files and
folders on computers, external storage devices, and cloud
storage. It protects sensitive data stored on devices or during
data transfer to prevent unauthorized access.

Risk analysis is the process of assessing the likelihood of an adverse event occurring within the
corporate, governmental, or environmental sectors.
The term risk analysis refers to the assessment process that identifies the potential for
any adverse events that may negatively affect organizations and the environment. Risk analysis
is commonly performed by corporations (banks, construction groups, health care, etc.),
governments, and nonprofits. Conducting a risk analysis can help organizations determine
whether they should undertake a project or approve a financial application, and what actions they
may need to take to protect their interests. This type of analysis facilitates a balance between
risks and risk reduction. Risk analysts often work in with forecasting professionals to minimize
future negative unforeseen effects.

KEY TAKEAWAYS

 Risk analysis seeks to identify, measure, and mitigate various risk exposures or hazards
facing a business, investment, or project.
 Quantitative risk analysis uses mathematical models and simulations to assign numerical
values to risk.
 Qualitative risk analysis relies on a person's subjective judgment to build a theoretical
model of risk for a given scenario.
 Risk analysis can include risk benefit, needs assessment, or root cause analysis.
 Risk analysis entails identifying risk, defining uncertainty, completing analysis models,
and implementing solutions.
Understanding Risk Analysis
Risk assessment enables corporations, governments, and investors to assess the probability that
an adverse event might negatively impact a business, economy, project, or investment. It is
essential for determining the worth of a specific project or investment and the best process(es) to
mitigate those risks. Risk analysis provides different approaches that can be used to assess
the risk and reward tradeoff of a potential investment opportunity.

A risk analyst starts by identifying what could potentially go wrong. These negatives must be
weighed against a probability metric that measures the likelihood of the event occurring.

Finally, risk analysis attempts to estimate the extent of the impact that will be made if the event
happens. Many identified risks, such as market risk, credit risk, currency risk, and so on, can be
reduced through hedging or by purchasing insurance.

Almost all large businesses require a minimum level of risk analysis. For example, commercial
banks need to properly hedge the foreign exchange exposure of overseas loans, while large
department stores must factor in the possibility of reduced revenues due to a global recession.
Risk analysis allows professionals to identify and mitigate risks but not completely avoid them.

Types of Risk Analysis


Risk-Benefits

Many people are aware of a cost-benefit analysis. In this type of analysis, an analyst compares
the benefits a company receives to the financial and non-financial expenses related to the
benefits. The potential benefits may cause other, new types of potential expenses to occur. In a
similar manner, a risk-benefit analysis compares potential benefits with associated potential
risks. Benefits may be ranked and evaluated based on their likelihood of success or the projected
impact the benefits may have.

Needs Assessment

A needs risk analysis is an analysis of the current state of a company. Often, a company will
undergo a needs assessment to better understand a need or gap that is already known.
Alternatively, a needs assessment may be done if management is not aware of gaps or
deficiencies. This analysis lets the company know where they need to spending more resources
in.

Business Impact Analysis

In many cases, a business may see a potential risk looming and wants to know how the situation
may impact the business. For example, consider the probability of a concrete worker strike to
a real estate developer. The real estate developer may perform a business impact analysis to
understand how each additional day of the delay may impact their operations.
Root Cause Analysis

Opposite of a needs analysis, a root cause analysis is performed because something is happening
that shouldn't be. This type of risk analysis strives to identify and eliminate processes that cause
issues. Whereas other types of risk analysis often forecast what needs to be done or what could
be getting done, a root cause analysis aims to identify the impact of things that have already
happened or continue to happen.

How to Perform a Risk Analysis


Though there are different types of risk analysis, many have overlapping steps and objectives.
Each company may also choose to add or change the steps below, but these six steps outline the
most common process of performing a risk analysis.

Step #1: Identify Risks

The first step in many types of risk analysis to is to make a list of potential risks you may
encounter. These may be internal threats that arise from within a company, though most risks
will be external that occur from outside forces. It is important to incorporate many different
members of a company for this brainstorming session as different departments may have
different perspectives and inputs.

A company may have already addressed the major risks of the company through a SWOT
analysis. Although a SWOT analysis may prove to be a launching point for further discussion,
risk analysis often addresses a specific question while SWOT analysis are often broader. Some
risks may be listed on both, but a risk analysis should be more specific when trying to address a
specific problem.

Step #2: Identify Uncertainty

The primary concern of risk analysis is to identify troublesome areas for a company. Most often,
the riskiest aspects may be the areas that are undefined. Therefore, a critical aspect of risk
analysis is to understand how each potential risk has uncertainty and to quantify the range of risk
that uncertainty may hold.

Consider the example of a product recall of defective products after they have been shipped. A
company may not know how many units were defective, so it may project different scenarios
where either a partial or full product recall is performed. The company may also run various
scenarios on how to resolve the issue with customers (i.e. a low, medium, or high engagement
solution.

Step #3: Estimate Impact


Most often, the goal of a risk analysis is to better understand how risk will financially impact a
company. This is usually calculated as the risk value, which is the probability of an event
happening multiplied by the cost of the event.

For example, in the example above, the company may assess that there is a 1% chance a product
defection occurs. If the event were to occur, it would cost the company $100 million. In this
example, the risk value of the defective product would be assigned $1 million.

The important piece to remember here is management's ability to prioritize avoiding potentially
devastating results. For example, if the company above only yielded $40 million of sales each
year, a single defect product that could ruin brand image and customer trust may put the
company out of business. Even though this example led to a risk value of only $1 million, the
company may choose to prioritize addressing this due to the higher stakes nature of the risk.

Step #4: Build Analysis Model(s)

The inputs from above are often fed into an analysis model. The analysis model will take all
available pieces of data and information, and the model will attempt to yield different outcomes,
probabilities, and financial projections of what may occur. In more advanced situations, scenario
analysis or simulations can determine an average outcome value that can be used to quantify the
average instance of an event occurring.

Step #5: Analyze Results

With the model run and the data available to be reviewed, it's time to analyze the results.
Management often takes the information and determines the best course of action by comparing
the likelihood of risk, projected financial impact, and model simulations. Management may also
request to see different scenarios run for different risks based on different variables or inputs.

Step #6: Implement Solutions

After management has digested the information, it is time to put a plan in action. Sometimes, the
plan is to do nothing; in risk acceptance strategies, a company has decided it will not change
course as it makes most financial sense to simply live with the risk of something happening and
dealing with it after it occurs. In other cases, management may want to reduce or eliminate the
risk.

Implementing solutions does not necessarily mean risk avoidance. A company can decide to
simply live with the current risks it faces. Other potential solutions may include buying
insurance, divesting from a product, restricting trade in certain geographical regions, or
sharing operational risk with a partner company.

Qualitative vs. Quantitative Risk Analysis


Quantitative Risk Analysis
Under quantitative risk analysis, a risk model is built using simulation or deterministic statistics
to assign numerical values to risk. The inputs are mostly assumptions and random variables.

For any given range of input, the model generates a range of output or outcomes. Risk managers
analyze the model's output using graphs, scenario analysis, and/or sensitivity analysis to make
decisions about mitigating and dealing with the risks.

A Monte Carlo simulation can generate a range of possible outcomes of a decision or action. The
simulation is a quantitative technique that repeatedly calculates results for the random input
variables using a different set of input values. The resulting outcome from each input is recorded,
and the final result of the model is a probability distribution of all possible outcomes.

The outcomes can be summarized on a distribution graph showing some measures of central
tendency such as the mean and median, and assessing the variability of the data through standard
deviation and variance. The outcomes can also be assessed using risk management tools such as
scenario analysis and sensitivity tables. A scenario analysis shows the best, middle, and worst
outcome of any event. Separating the different outcomes from best to worst provides a
reasonable spread of insight for a risk manager.

For example, an American company that operates globally might want to know how its bottom
line would fare if the exchange rate of select countries strengthened. A sensitivity table shows
how outcomes vary when one or more random variables or assumptions are changed.

Elsewhere, a portfolio manager might use a sensitivity table to assess how changes to the
different values of each security in a portfolio will impact the portfolio's variance. Other types of
risk management tools include decision trees and break-even analysis.

Qualitative Risk Analysis

Qualitative risk analysis is an analytical method that does not identify and evaluate risks with
numerical and quantitative ratings. It involves a written definition of the uncertainties, an
evaluation of the extent of the impact (if the risk ensues), and countermeasure plans in the case
of a negative event.

Examples of qualitative risk tools include SWOT analysis, cause-and-effect diagrams, decision
matrixes, and game theory. A firm that wants to measure the impact of a security breach on its
servers may use a qualitative risk technique to help prepare it for any lost income that may occur
from a data breach.

While most investors are concerned about downside risk, mathematically, the risk is the variance
both to the downside and the upside.

Example of Risk Analysis: Value at Risk (VaR)


Value at risk (VaR) is a statistic that measures and quantifies the level of financial risk within a
firm, portfolio, or position over a specific time frame. Investment and commercial banks often
use this metric to determine the extent and occurrence ratio of potential losses in their
institutional portfolios. Risk managers use VaR to measure and control the level of risk exposure.
One can apply VaR calculations to specific positions or whole portfolios or to measure firm-wide
risk exposure.

VaR is calculated by shifting historical returns from worst to best, assuming that returns will be
repeated, especially where risk is concerned. As a historical example, let's look at the Nasdaq
100 ETF, which trades under the symbol QQQ (sometimes called the "cubes") and started
trading in March 1999.

In January 2000, the ETF returned 12.4%. However, there are points at which the ETF resulted
in losses as well. At its worst, the ETF ran daily losses of 4% to 8%. This period is referred to as
the ETF's worst 5%. Based on these historic returns, we can assume with 95% certainty that the
ETF's largest losses won't go beyond 4%. So if we invest $100, we can say with 95% certainty
that our losses won't go beyond $4.

One important thing to remember is that VaR doesn't provide analysts with absolute certainty.
Instead, it's an estimate based on probabilities. The probability gets higher if you consider the
higher returns and only consider the worst 1% of the returns. The Nasdaq 100 ETF's losses of
7% to 8% represent the worst 1% of its performance. We can thus assume with 99% certainty
that our worst return won't lose us $7 on our investment. We can also say with 99% certainty that
a $100 investment will only lose us a maximum of $7.

Advantages and Disadvantages of Risk Analysis


Risk Analysis

Pros
 May aid in minimizing losses due to management preemptively forming a risk plan
 May allow management to quantify risks and assign dollars to future events
 May protect company resources, produce better processes, and mitigate overall risk

Cons
 Relies heavily on estimates, so it may be difficult to perform for certain risks
 Can not predict unpredictable, black swan events
 May underestimate risk magnitude or occurence, leading to overconfident operations

Pros of Risk Analysis

Risk analysis allows companies to make informed decisions and plan for contingencies before
bad things happen. Not all risks may materialize, but it is important for a company to understand
what may occur so it can at least choose to make plans ahead of time to avoid potential losses.

Risk analysis also helps quantify risk, as management may not know the financial impact of
something happening. In some cases, the information may help companies avoid unprofitable
projects. In other cases, the information may help put plans in motion that reduce the likelihood
of something happen that would have caused financial stress on a company.

Risk analysis may detect early warning signs of potentially catastrophic events. For example,
risk analysis may identify that customer information is not being adequately secured. In this
example, risk analysis can lead to better processes, stronger documentation, more robust internal
controls, and risk mitigation.

Cons of Risk Analysis

Risk is a probabilistic measure and so can never tell you for sure what your precise risk exposure
is at a given time, only what the distribution of possible losses is likely to be if and when they
occur. There are also no standard methods for calculating and analyzing risk, and even VaR can
have several different ways of approaching the task. Risk is often assumed to occur using normal
distribution probabilities, which in reality rarely occur and cannot account for extreme or "black
swan" events.

The financial crisis of 2008, for example, exposed these problems as relatively benign VaR
calculations that greatly understated the potential occurrence of risk events posed by portfolios
of subprime mortgages.

Risk magnitude was also underestimated, which resulted in extreme leverage ratios within
subprime portfolios. As a result, the underestimations of occurrence and risk magnitude left
institutions unable to cover billions of dollars in losses as subprime mortgage values collapsed.

What Is Meant by Risk Analysis?


Risk analysis is the process of identifying and analyzing potential future events that may
adversely impact a company. A company performs risk analysis to better understand what may
occur, the financial implications of that event occurring, and what steps it can take to mitigate or
eliminate that risk.

What Are the Main Components of a Risk Analysis?


Risk analysis is sometimes broken into three components. First, risk assessment is the process of
identifying what risks are present. Second, risk management is the procedures in place to
minimize the damage done by risk. Third, risk communication is the company-wide approach to
acknowledging and addressing risk. These three main components work in tandem to identify,
mitigate, and communicate risk.

Why Is Risk Analysis Important?


Sometimes, risk analysis is important because it guides company decision-making. Consider the
example of a company considering whether to move forward with a project. The decision may be
as simple as identifying, quantifying, and analyzing the risk of the project.
Risk analysis is also important because it can help safeguard company assets. Whether it be
proprietary data, physical goods, or the well-being of employees, risk is present everywhere.
Companies must be mindful of where it most likely to occur as well as where it is most likely to
have strong, negative implications.

The Bottom Line


Risk analysis is the process of identifying risk, understanding uncertainty, quantifying the
uncertainty, running models, analyzing results, and devising a plan. Risk analysis may be
qualitative or quantitative, and there are different types of risk analysis for various situations.

SPONSORED
Trade on the Go. Anywhere, Anytime
One of the world's largest crypto-asset exchanges is ready for you. Enjoy competitive fees and
dedicated customer support while trading securely. You'll also have access to Binance tools that
make it easier than ever to view your trade history, manage auto-investments, view price charts,
and make conversions with zero fees. Make an account for free and join millions of traders and
investors on the global crypto market.
Compare Accounts
Advertiser Disclosure
PROVIDER
NAME
DESCRIPTION

You might also like