ITPEC IP October 2019 Question 37
Which of the following is an appropriate description of risk assessment in information security?
Explanation
Analysing and assessing risks to identified assets, and deciding against criteria whether action is needed — that is risk assessment.
In information security risk management (ISO/IEC 27001, ISO 31000), risk assessment consists of three steps:
- •Risk identification: find the assets and the threats and vulnerabilities that affect them
- •Risk analysis: estimate each risk's likelihood and impact to determine its level
- •Risk evaluation: compare the level with the risk criteria and decide whether treatment is needed and in what order
Treatment (avoid, reduce, transfer, accept) follows as a separate step.
Answer (b)
Why not others:
- •(a) — quarantining a virus and limiting its spread is incident response, a countermeasure taken after an infection
- •(c) — confirming that a user is genuine with information registered in advance is authentication
- •(d) — calculating the cost effectiveness of an information system is an investment evaluation, not an assessment of security risks
Key rule: Risk assessment = identification, analysis and evaluation of risks; deciding and applying the countermeasure is risk treatment, which comes after it.
Security · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official IP past-paper collection or Report an issue.