CRISC Certified in Risk and Information Systems ControlInformation Technology and SecurityMedium
A large e-commerce company is experiencing a significant increase in distributed denial-of-service (DDoS) attacks targeting its online storefront during peak sales periods. The security team has implemented advanced DDoS protection services and traffic filtering rules. However, the attacks are still causing occasional service disruptions. What is the MOST likely next step the risk manager should recommend to address the remaining risk?
- ADiscontinue online sales during peak periods to avoid attacks.
- BAccept the current level of service disruption as an unavoidable business risk.
- CIncrease the budget for marketing to offset potential revenue loss.
- DConduct a cost-benefit analysis of further security investments versus potential losses.
Show answer & explanationAnswer & explanation
Correct answer: D. Conduct a cost-benefit analysis of further security investments versus potential losses.
After implementing initial mitigation, if residual risk remains significant, the next logical step is to evaluate whether further investment in controls is economically justified against the potential losses from the risk. This involves a cost-benefit analysis.
Why the other options are wrong
- A. Discontinuing online sales is an extreme measure (risk avoidance) that would severely impact business operations and revenue, likely disproportionate to the current situation.
- B. Accepting the risk without further analysis, especially when disruptions are 'occasional,' might be premature and could lead to significant unmanaged losses.
- C. Increasing marketing budget does not address the security risk itself; it's a separate business strategy.
Cost-Benefit Analysis (CBA) in Risk Management
A systematic process for calculating and comparing the benefits and costs of a project, decision, or proposed action (e.g., implementing a new security control).
- Evaluates economic feasibility of risk treatment.
- Compares cost of control vs. cost of risk.
- Helps justify security investments.
Memory trick: After fixing some, 'CBA' if more's 'Worth It'.