A financial institution is implementing a new online banking platform. During the risk assessment, a high-impact, medium-likelihood risk of unauthorized access to customer accounts via a zero-day exploit is identified. The cost of implementing a robust intrusion prevention system (IPS) and advanced threat intelligence feeds to mitigate this risk is estimated at $500,000. The potential financial loss from a single successful breach is estimated at $10 million, with a 5% chance of occurring annually if no controls are implemented. What is the most appropriate risk response strategy for the institution to adopt?
- ATransfer the risk by purchasing a cyber insurance policy.
- BAvoid the risk by not launching the online banking platform.
- CAccept the risk, as the cost of mitigation is high.
- DMitigate the risk by implementing the IPS and threat intelligence feeds.
Show answer & explanationAnswer & explanation
Correct answer: D. Mitigate the risk by implementing the IPS and threat intelligence feeds.
The potential annual loss without mitigation is $10,000,000 * 0.05 = $500,000. Implementing controls costs $500,000, which is equal to the potential annual loss. This makes mitigation a viable and appropriate option, especially considering the reputational damage and regulatory fines that are not factored into the financial loss calculation. Accepting the risk would mean exposing the institution to significant potential losses. Avoiding the risk by not launching the platform would mean losing competitive advantage and business opportunities. Transferring the risk through insurance might be part of a broader strategy but doesn't eliminate the need for primary controls, particularly for a high-impact risk.
Why the other options are wrong
- A. Transferring risk through insurance is a secondary control and does not address the root cause or prevent the incident from occurring, which is crucial for high-impact risks.
- B. Avoiding the risk by not launching the platform is an extreme measure that would prevent business benefits, and other options exist.
- C. Accepting a high-impact risk with a clear mitigation path that is economically reasonable is generally not advisable.
Risk Mitigation
A risk response strategy that involves taking actions to reduce the likelihood or impact of a risk event.
- Aims to reduce exposure to risk.
- Often involves implementing controls or countermeasures.
- Cost-benefit analysis is crucial for determining feasibility.
Memory trick: Always Assess All Options Carefully.