Question

1. What are the definitions of a (security) risk assessment in the textbook and in Appendix B of NIST SP 800-53a? Which definition do you prefer? Why?

2. What is a security control? Give two examples of a security control.

3. List the primary benefits of a security risk assessment. Which one do you think is the most important? Why?

4. If security spending is not based on a security risk assessment, how are spending priorities typically determined?

5. Why are security controls assessed?
6. How do the guidelines provided in NIST SP 800-53A help achieve more secure information systems?

Answer 1

As it is Chegg policy to answer one question per answer. Hence, I am answering the first question and request you to post the rest of the question as individual questions. Thank you.

What are the definitions of a (security) risk assessment in the textbook and in Appendix B of NIST SP 800-53a? Which definition do you prefer? Why?

The definition of the risk assessment according to the NIST is as follows:

• Risk assessment is one of the most fundamental components of organizational risk management processes. They are also used for identifying, estimating and prioritizing risks to the organizational operations, assets, individuals or any other organization which will be resulting from the operation and use of the information systems.
• I prefer this definition as it provides the perfect purpose of why we are using risks assessments in our daily routine of security checks and what are the risk responses that must be taken care of.
• It also clears the purpose of risk assessments for various purposes like:
  • finding vulnerabilities
  • identifying relevant threats for the organization
  • impact of the threats on the organization

Hence, this is the main reason why I prefer this definition of the risk assessment