An organization relies on a critical legacy system that processes sensitive data but lacks modern security features and cannot be easily patched. Replacing the system is prohibitively expensive and time-consuming. Which of the following risk treatment strategies is MOST appropriate for the CISO to recommend in this situation?
- ARisk Avoidance, by completely discontinuing the use of the legacy system.
- BRisk Transfer, by purchasing a comprehensive cybersecurity insurance policy.
- CRisk Acceptance, by formally acknowledging the risk without further action.
- DRisk Mitigation, by implementing compensating controls around the legacy system.
Show answer & explanationAnswer & explanation
Correct answer: D. Risk Mitigation, by implementing compensating controls around the legacy system.
Given that replacing the system (avoidance) is too expensive and accepting the risk without action is irresponsible for sensitive data, the most appropriate strategy is risk mitigation. This involves implementing compensating controls (e.g., network segmentation, strict access controls, intrusion detection) around the legacy system to reduce its exposure and impact, thereby mitigating the risk without direct modification to the system itself.
Why the other options are wrong
- A. Discontinuing use is explicitly stated as prohibitively expensive, making this impractical.
- B. Insurance transfers financial impact, but does not reduce the likelihood or direct impact of a breach, and is often combined with other strategies.
- C. Formally accepting such a high risk for sensitive data without any action is generally not advisable for critical systems.
Risk Treatment Strategies
Risk treatment strategies are the approaches an organization takes to manage identified risks, typically categorized as Avoid, Transfer, Mitigate, or Accept.
- Avoid: Eliminate the activity causing the risk.
- Transfer: Shift the risk to a third party (e.g., insurance).
- Mitigate: Reduce the likelihood or impact of the risk.
- Accept: Acknowledge and monitor the risk without further action.
Memory trick: When the old castle can't be rebuilt, you build defenses around it.