CRISC Certified in Risk and Information Systems ControlIT Risk AssessmentHard
A multinational corporation is updating its IT risk register. The current register includes entries like 'Risk of Phishing Attacks' and 'Risk of Malware Infection'. The risk manager wants to improve the specificity and actionability of these entries to better support risk response planning. Which of the following is the BEST example of an improved risk scenario for 'Risk of Phishing Attacks'?
- AEmployees clicking on malicious links in phishing emails, leading to credential compromise and unauthorized data access.
- BPhishing attacks resulting in financial loss and reputational damage.
- CLow likelihood of phishing attacks, high impact.
- DNeed for security awareness training to prevent phishing attacks.
Show answer & explanationAnswer & explanation
Correct answer: A. Employees clicking on malicious links in phishing emails, leading to credential compromise and unauthorized data access.
An actionable risk scenario clearly outlines the threat, the vulnerability, the event sequence, and the direct impact on assets. Option B provides this level of detail: 'Employees clicking on malicious links' (vulnerability/action), 'phishing emails' (threat vector), 'credential compromise' (event), and 'unauthorized data access' (impact/asset consequence).
Why the other options are wrong
- B. This describes the high-level impact but lacks the specific chain of events that leads to the impact, making it less actionable.
- C. This is a qualitative risk rating, not a detailed scenario. It lacks the 'how' and 'what' of the event.
- D. This is a control recommendation, not a risk scenario. It states a solution rather than describing the risk event itself.
Actionable Risk Scenarios
Detailed descriptions of potential risk events, specifying the threat, vulnerability, assets, and consequences, enabling targeted risk response.
- Include 'who', 'what', 'how', and 'impact'.
- Support effective risk response planning.
- Are specific and measurable, not vague.
Memory trick: Scenario Specifics: Who, What, How, and the Ugly Outcome.