ITPEC IP October 2019 Question 36

An unexpected power failure caused by a disaster such as lightning — a threat is an event that can cause harm to information assets.

Risk assessment separates two things:

• •Threat: a potential cause of an incident that harms assets, from outside or inside: disasters, power failures, attacks, errors, theft
• •Vulnerability: a weakness in the assets or their controls that a threat can exploit: missing encryption, poor procedures, faulty locks

A power failure from a lightning strike is an event that can stop systems and destroy data, so it is a threat.

Answer (d)

Why not others:

• •(a) — unencrypted communication is a weakness that eavesdropping can exploit, a vulnerability
• •(b) — inconsistent handling procedures for confidential documents are a weakness in management, a vulnerability
• •(c) — a door that cannot be locked is a physical weakness that intruders can exploit, a vulnerability

Key rule: Risk arises when a threat (a cause of harm) exploits a vulnerability (a weakness); an event that happens to assets is a threat, a condition of the assets is a vulnerability.

Security · AI-written, may contain errors