Reference no: EM1364119

"If an organization has three information assets to evaluate for risk management as shown in the accompanying data, which vulnerability should be evaluated for additional controls first? Which one should be evaluated last?

Explain your reasons.

a. Switch L47 connects a network to the Internet. It has two vulnerabilities: it is susceptible to hardware failure at a likelihood of 0.2, and it is subject to an SNMP buffer overflow attack at a likelihood of 0.1. This switch has an impact rating of 90 and has no current controls in place. You are 75 percent certain of the assumption and data.

b。Server WebRV6托管公司网站并执行电子商务交易。它具有可以通过发送无效的Unicode值来攻击的Web服务器版本。该攻击的可能性估计为0.1。该服务器的影响值为100，并且已经植入了控制漏洞的影响，将脆弱性的影响降低了75％。您是80％的假设和数据。

c. Operators use a MGMT45 control console to monitor operations in the server room. It has no passwords and is susceptible to unlogged misuse by the operators. Estimates show the likelihood of misuse is 0.1. There are no controls in place on this asset; it has an impact rating of 5. You are 90 percent certain of the assumptions and data.