ITPEC IP October 2023 Question 43
Which of the following is an appropriate combination of terms or phrases to be inserted into A and B in the description below concerning identification of information security risks in ISMS?
A of ISMS, the risks that cause loss of confidentiality, B, or availability of information are identified.
Explanation
A: In the scope, B: integrity — an ISMS identifies, within its defined scope, the risks of losing the confidentiality, integrity or availability of information.
An ISMS (ISO/IEC 27001) starts by fixing its scope: the departments, sites, systems and information assets it covers. Risk assessment is then carried out for the assets inside that scope; what lies outside is not managed by this ISMS.
Information security is defined as preserving three properties of information, the CIA triad:
- •Confidentiality — only authorised people can see it
- •Integrity — it is accurate and complete, not altered or destroyed improperly
- •Availability — authorised people can use it when they need it
A risk is identified by asking which asset could lose which of these properties, so A is "In the scope" and B is "integrity".
Answer (c)
Why not others:
- •(a) — has integrity right, but risks are identified for the assets inside the ISMS scope, not outside it
- •(b) — wrong in both blanks: outside the scope, and vulnerability is not a property of information
- •(d) — the scope is right, but a vulnerability is a weakness that a threat exploits: a cause of the risk, not something the information loses
Key rule: A risk is a threat exploiting a vulnerability of an asset so that the asset loses confidentiality, integrity or availability; vulnerability and threat are causes, CIA is what is lost.
Security · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official IP past-paper collection or Report an issue.