"The risk analysis is the most complex part of a properly conducted disaster recovery plan. However, a clear understanding of the primary goal of a risk analysis, a grasp of the critical terminology, and adherence to a well-structured process renders this complex activity manageable."

The Goal of a Risk Analysis
"Disaster recovery planning seeks to provide a level of protection for corporate assets that will hopefully ensure a company's survival in the face of disastrous events. Before a protection strategy can be implemented, three basic questions must be answered."

   o What am I protecting?
   o What am I protecting against?
   o How much money, time, and effort should I expend?"

broken down

WTGR

Terms
Used

To better understand discussions on Risk and Threat Analysis, it is necessary that readers understand what is meant by some terms particular to this part of the security industry.

   o Asset: something worth something
        o it could be a human asset - a person you need to do something
        o it could be a facility, structure or building
        o it could be a piece of valuable equipment or a vehicle
        o it could be something related to communications and transportation
        o it could be data, such as detailed customer information
                 - basically anything of value that you want to protect

basically, the definition of an asset is something which is valuable for your company to have to carry out the critical aspects of business

Terms
Used

threats by themselves are not a problem, it is a problem when that threat is facilitated by a person "bringing it", or a situation causing the threat to go from "maybe" to "now"

Terms
Used

any weakness which, left unprotected, could cause the company to lose productivity 
or something that threatens asset value; 
for example, soil erosion from clear cutting a forest may create a potential flood if the typhoon is strong that year, which could flood a mining project that another company had nearby in the same region 

Terms
Used

In international business, an example of an exposure could the consequence of a particular currency rising very high, which wipes out the profit margin expected in an enterprise

Terms
Used

In the case of preventing against a flood, you could dig a large trench to divert flood water around the mine shaft so the drifts will not be flooded

In the case of preventing against political risk such as a violent change of government, you can hire a security force to repel looters and defend against small bands of soldiers that want to pillage your facilities

In the case of an I.T. failure, countermeasure could mean that corporate data is backed up at another location so if the main server fails, you have a back-up
Or countermeasures could mean that if you are hacked, you have the ability to not just know you are hacked, but actually do something to repell further attacks of the hacker, or even identify him to authorities