ITPEC IP October 2020 Question 41
When risk treatment in risk management for information security is divided into the four (4) categories of risk transfer, avoidance, acceptance, and mitigation, which of the following is an appropriate example of risk mitigation?
Explanation
Encrypting the data on the notebook PC's hard disk — the PC is still used and can still be lost, but encryption makes the damage of a loss smaller, which is risk mitigation.
The four treatments differ in what happens to the risk:
- •Avoidance — stop the activity that creates the risk, so the risk disappears with it
- •Transfer — shift the financial consequences to another party, such as an insurer or an outsourcer
- •Acceptance — knowingly keep the risk as it is and take no further measures
- •Mitigation (reduction) — take measures that lower the probability or the impact of the risk
A finder or thief cannot read the encrypted data without the key, so the impact of losing the PC shrinks while the activity goes on.
Answer (d)
Why not others:
- •(a) — withdrawing from the service removes the activity that causes the risk: risk avoidance
- •(b) — insurance moves the financial loss of a leak to the insurer: risk transfer
- •(c) — judging the remaining risk low and adding no countermeasures is risk acceptance
Key rule: Ask what happens to the risk: it goes with the activity (avoidance), someone else pays for it (transfer), it is kept as it is (acceptance), or it is made smaller (mitigation).
Security · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official IP past-paper collection or Report an issue.