Chapter 6

Question 1

What are the steps of Defensive Programming?

Answer 1

• Identify: capture likelihood and impact
• Analyze: assess using risk score
• Treat: Choose to remove, control, anticipate, accept, or transfer risk
• Design Defensively
• Evaluation: Re-assess risks again

Question 2

Why are Metrics Important in Risk Assessment?

Answer 2

They turn claims into evidence

Question 3

How Does One Control the Impact of a Risk?

Answer 3

Impact only drops if the control limits the consequences when failure occurs

Question 4

How are Risks Primarily Affected in Risk Management?

Answer 4

The likelihood is always affected but the damage is usually the same

Question 5

What are the Risk Levels in Risk Assessments?

Answer 5

• High: 15-25
• Medium: 7-14
• Low: 1-6

Question 6

What are the Risk Treatment Options?

Answer 6

• Avoid/Eliminate: remove risk
• Control/Reduce/Mitigate: control likelihood
• Detect/Respond/Recover: anticipate risk
• Transfer/Share: pass risk
• Assume/Accept/Retain: acknowledge and accept risk

Question 7

What is the Preferred Treatment for High Risk Threats?

Answer 7

• Avoid/Eliminate, Mitigate/Control
• Add a Detect/Recover if severe impact

Question 8

What is the Preferred Treatment for Medium Risk Threats?

Answer 8

Control/Mitigate, Detect/Recover

Question 9

What is the Preferred Treatment for Low Risk Threats?

Answer 9

Accept/Transfer with monitoring

Question 10

Why Would an Organization Assume/Accept/Retain a Risk?

Answer 10

• The impact is low
• The cost of mitigation is higher than the risk itself