Information assets to estimate for risk management purposes

Assignment Help Basic Computer Science

Reference no: EM1369691

1. If an organization has three information assets to evaluate for risk management purposes which vulnerability should be evaluated for additional controls first? Which vulnerability should be evaluated last?

n.b. the formula for risk is:

(The likelihood of the occurrence of a vulnerability) * (The value of the information asset) - (The percentage of risk mitigated by current controls) + (The uncertainty of current knowledge of the vulnerability).
Explain your reasons.

a. Switch L47 connects a network to the Internet. It has two vulnerabilities: it is susceptible to hardware failure at a likelihood of 0.2, and it is subject to an SNMP buffer overflow attack at a likelihood of 0.1. This switch has an impact rating of 90 and has no current controls in place. You are 75 percent certain of the assumption and data.

b. Server WebSrv6 hosts a company Web site and performs e-commerce transactions. It has a Web server version that can be attacked by sending it invalid Unicode values. The likelihood of that attack is estimated at 0.1. The server has been assigned an impact value of 100 and a control has been implanted that reduces the impact of the vulnerability by 75 percent. You are 80 percent certain of the assumption and data.

c. Operators use a MGMT45 control console to monitor operations in the server room. It has no passwords and is susceptible to unlogged misuse by the operators. Estimates show the likelihood of misuse is 0.1. There are no controls in place on this asset; it has an impact rating of 5. You are 90 percent certain of the assumptions and data.

Reference no: EM1369691

Questions Cloud

What is profit-maximizing level of hiring for firm : What is profit-maximizing level of hiring for firm. How is it determined. What is equilibrium quantity of labour hired in market. Does it make sense given number of firms.

What is probability that these students will spend : What is probability that these 64 students will spend a combined total between $703.59 and $728.45.

Identifying the nash equilibrium or multiple equilibrium : Suppose two high tech companies, X and Y, are the only producers of a new product that is used my numerous computer manufacturers.

What is short-run effect of an increasing us output : All else equal, what is short-run effect of an increasing US output Y on US interest rate. All else equal, what is short-run effect of an increasing US prices P on US interest rate.

Information assets to estimate for risk management purposes : If the organization has three information assets to estimate for risk management purposes which vulnerability must be estimated for additional controls first? Which vulnerability must be evaluated last?

What determines price elasticity of demand for a product : What determines price elasticity of demand for a product. key determinants of price elasticity of demand are as follows: i. Availability of close substitutes- gas stations across street, very elastic.

What does production look like : If a person can either fish or chop coconuts for subsistence, what does production look like.

Is this due to taxes or is it more fundamental : Y at PPP is only 0.05. It is well-known that investment rate dierenHSL39502.bmpe when measured at a common set of prices while very small when measured at domestic prices.

Find possibility of setting up wireless network in building : Assume you are a wireless network contractor, and you are meeting with potential client over lunch to explain possibility of setting up wireless network in client's building.

User Account

All Pages