118k views
3 votes
A Chief Information Security Officer (CISO) recently changed jobs into a new industry. The CISO's first task is to write a new, relevant risk assessment for the organization.

Which of the following would BEST help the CISO find relevant risks to the organization? (Choose two.)

A. Perform a penetration test.
B. Conduct a regulatory audit.
C. Hire a third-party consultant.
D. Define the threat model.
E. Review the existing BIA.
F. Perform an attack path analysis.

User Sliver
by
7.5k points

1 Answer

4 votes

Final answer:

A new Chief Information Security Officer should define the threat model and review the existing Business Impact Analysis to best identify the relevant risks to an organization.

Step-by-step explanation:

When a new Chief Information Security Officer (CISO) begins assessing the risks facing an organization, particularly in a new industry, it's imperative to pinpoint the specific risks unique to that organization's operations and environment. Two methods that would best assist in finding relevant risks are Defining the threat model and Reviewing the existing Business Impact Analysis (BIA).

Defining the threat model is a fundamental step that involves a systematic approach to recognizing potential threats to the organization's cybersecurity posture. This process includes the identification of valuable assets, the threats to those assets, the vulnerabilities that might be exploited by the threats, and the potential impact on the organization. Crafting a threat model helps in anticipating how an attacker might breach the organization's systems, which improves the CISO's capacity to proactively mitigate those risks.

Reviewing the existing BIA is critical because it outlines the potential impacts resulting from disruption of business functions and processes. A BIA is a cornerstone of the broader business continuity plan and directly feeds into the risk assessment process. It helps in identifying not only the critical systems and assets that need protection but also serves as a baseline for understanding the tolerable downtime and potential losses in the case of an incident.

While other options like performing a penetration test, conducting a regulatory audit, or engaging a third-party consultant could provide valuable insights into the organization's security posture, they are more tactical and immediate in nature and might not offer the strategic, comprehensive view that a new CISO would require for an industry-tailored risk assessment.

User Alhassan
by
7.8k points