Chapter 13, Problem 12RQ

Explanation of Solution

Steps to conduct an effective computer security risk assessment:

• First, the set of IS assets about which the company is most bothered are identified.
• It is necessary to identify the loss events or the associated risks and threats, like insider fraud or distributed denial-of-service attack.
• The frequency of the events like potential threats should be assessed.
• The impact of each threat that has been occurred has to be determined...