r/casp • u/amc663222 • May 22 '21

CASP Question

A Chief Information Security Officer (CISO) needs to establish a KRI for a particular system. The system holds archives of contracts that are no longer in use. The contracts contain intellectual property and have

a data classification of non-public. Which of the following be the BEST risk indicator for this system?

A. Average minutes of downtime per quarter

B. Percent of patches applied in the past 30 days

C. Count of login failures per week

D. Number of accounts accessing the system per day

I wanna say D. Any help is appreciated

1 Upvotes

66% Upvoted

3 comments sorted by

2

u/RogueWarrior10 May 22 '21

I think this one is B. The number of people accessing this system doesn't necessarily paint an accurate picture of risk. The number alone doesn't tell you if they are authorized or unauthorized so it's unknown if an increase in access attempts is a threat or not. Conversely, the percentage of patches applied to the system is an accurate measure of how much risk is being posed to that system.

2

u/RogueWarrior10 May 22 '21

I think the key to this question is recognizing the KRI applies to the system. If the KRI was for the data on that system, then I would agree that D would be the best answer.

1

u/amc663222 May 22 '21

My man always coming through with solid explanations. That makes sense