CRISC Certified in Risk and Information Systems ControlIT Risk AssessmentEasy
A healthcare organization is developing a risk scenario for 'Unauthorized Access to Patient Records via a Phishing Attack'. Which component of a well-structured risk scenario MOST accurately describes the motivation and capabilities of the threat actor?
- AVulnerability exploited
- BBusiness impact
- CThreat source
- DAsset under threat
Show answer & explanationAnswer & explanation
Correct answer: C. Threat source
The 'Threat source' component of a risk scenario describes who or what initiates the risk event, including their motivation, capabilities, and intent. In this case, it refers to the phisher.
Why the other options are wrong
- A. Vulnerability exploited refers to the weakness (e.g., lack of user training), not the actor's characteristics.
- B. Business impact describes the consequences (e.g., regulatory fines), not the actor's motivation.
- D. The asset under threat is the patient records, not the actor's motivation.
Risk Scenario Components
Key elements that define a specific risk event, typically including actors, assets, vulnerabilities, and impacts.
- Provides a narrative description of a potential risk.
- Helps in understanding the context and consequences of a risk.
- Facilitates communication and risk treatment planning.
Memory trick: A risk scenario is a play with actors, a stage, and consequences.