Title: 04:HW01
Course: IN 2001 Principle of Information Assurance > Section: Module 4: Chapter Four

If an organization has three information assets to evaluate for risk management as shown in the accompanying data, which vulnerability should be evaluated for additional controls first?  Which one should be evaluated last? Explain your answer and show additional Web resources.

An evaluation of the provided asset vulnerabilities results in:
Asset A:
This is a switch that has two vulnerabilities.  The first involves a hardware failure likelihood of 0.2 and the second involves a buffer attack likelihood of 0.1.  The switch has an impact rating of 90.  Assumptions made on this asset have a 75% certainty.
Asset B:
This is a web server that deals with e-commerce transactions.  It has one vulnerability with a likelihood of 0.1. However it has an impact rating of 100. Assumptions made on this asset have an 80% certainty.
Asset C:
This is a control console with no password protection with a likelihood of attack of 0.1.  It has no controls and an impact rating of 5.  Assumptions made on this asset have a 90% certainty.