Student: Email:
Time on Task:
12 hours, 18 minutes
Progress:
100%
Report Generated:
Performing a Risk Assessment (3e)
Managing Risk in Information Systems, Third Edition - Lab 04
Guided Exercises
Part 1: Prepare for a Risk Assessment
4. Given the scenario provided above, identify the level of the risk assessment you will perform.
Your risk assessment may cover multiple tiers.
Tier 1 risk assessment would handle all the patch management procedures, storage and password
policies. Tier 2 risk assessment would provide input concerning tests, common controls and overall IT
infrastructure management. Tier 3 risk assessment would handle implementation regarding account
management. It would also provide consistent monitoring over processes and password policy
enforcement throught technical implementation.
5. For three of the five vulnerabilities identified in the scenario provided above, identify the Tier
that would best address the vulnerability and provide your justification.
Tier 1 risk assessment would best address those vulnerabilities because it provides an organization-
wide view of procedures, information security programs, policies, procedures, and guidance. Also too,
tier 1 would address ongoing authorizations of information systems and common controls, minimum
organization-wide security controls, and monitoring strategies. All this would cover all the
vulnerabilities discovered in the organization.
7. Describe the purpose of this risk assessment.
The purpose of this risk assessment is to produce the information the assessment is designed for, as
well as the set of decisions that must come from it.
