Question

A risk analyst is populating a qualitative risk register for a new customer-facing web application. For an entry describing 'exploitation of an unpatched authentication vulnerability,' the analyst must assign a likelihood rating and an impact rating. Which combination of factors should the analyst use as the primary basis for these two ratings, respectively?

Accepted Answer

Likelihood based on threat frequency and exploitability of the vulnerability; impact based on the effect on business objectives if the event occurs

Answer

Likelihood based on the cost of remediation; impact based on the number of controls already implemented

Answer

Likelihood based on the severity score in the vulnerability scanner; impact based on the age of the affected system

Answer

Likelihood based on management's risk appetite; impact based on the annual maintenance budget for the application