Free Preparation Discussions
MENU
PECB ISO-IEC-27005-Risk-Manager Exam - Topic 1 Question 25 Discussion
Topic #: 1
Which of the following risk assessment methods provides an information security risk assessment methodology and involves three phases build asset-based threat profiles, identify infrastructure vulnerabilities, and develop security strategy and plans?
OCTAVE-S (Operationally Critical Threat, Asset, and Vulnerability Evaluation for Small Organizations) is a risk assessment methodology tailored for small organizations. It provides a structured approach for identifying and managing information security risks. The OCTAVE-S method involves three main phases:
Building asset-based threat profiles, where critical assets and their associated threats are identified.
Identifying infrastructure vulnerabilities by assessing the organization's technological infrastructure for weaknesses that could be exploited by threats.
Developing security strategy and plans to address the identified risks and improve the overall security posture.
The OCTAVE-S method aligns with the description provided in the question, making it the correct answer. MEHARI and TRA are other risk assessment methods, but they do not specifically follow the three phases outlined above.
Pamella
3 days agoLemuel
8 days agoChristiane
13 days agoPeggy
19 days agoVicky
24 days agoFrederic
29 days agoFausto
1 month agoEdgar
1 month agoReuben
1 month agoLino
2 months agoAnnamae
2 months agoGayla
2 months ago