Security risk assessment prioritizes security risks so that testing aligns with business security objectives.
Which ONE of the following options would cause a misalignment between the business security objectives and the tests?
Security threats are not independent of assets: an asset’s value, vulnerabilities, exposure, and business impact determine the significance of a threat. Treating threats as asset-independent undermines risk-based prioritization and can misalign testing with business security objectives.
Community Discussion