Fórum de discussão

Eu dei uma revisada nos slides dos módulos 3 e 4 e achei que a resposta que mais se assemelha ao que foi dito sobre análise e tratamento de riscos seria a penúltima "A análise de riscos é utilizada em conjunto com medidas de segurança para reduzir os riscos para um nível aceitável".

Dessa forma, como realmente fiquei em dúvida em qual é o conceito correto, gostaria de alguma explicação ou talvez a referência de um slide que contenha resposta parecida com a do Quiz.

Obrigado!

Mateus

opções C e D são muito parecidas. Entretanto, D destaca aspectos mais importantes para o negócio, como "tempo hábil".

A análise de riscos não vai implementar as medidas, o foco é na identificação e análise dos riscos. Entretanto, isto serve como base para priorizar o que tem que ser implementado primeiro.

Veja texto de referência do ebook do exin:

5.1 Risk analysis

Risk analysis is a tool that is used in risk management. The purpose of carrying out a risk analysis is

to clarify which threats are relevant to the operational processes and to identify the associated risks.

The appropriate security level, along with the associated security measures, can then be determined.

A risk analysis is used to ensure that the security measures are deployed in a cost-effective and

timely manner, and consequently provide an effective answer to the threats.

Security is a complex issue, even for experienced security specialists. It is not easy to find the right

balance between security measures that are too stringent and those that are ineffective or

inappropriate. A great deal of money is spent on unnecessary security measures due to not having a

well thought out security concept as foundation. An aid that can help to arrive at a well thought out

security concept is the risk analysis.

A risk analysis helps the company to correctly assess the risks and determine the correct and

balanced security measures. Management can also find out the costs that are involved in taking the

appropriate measures.

A risk analysis has four main objectives:

1. To identify assets and their value

2. To determine vulnerabilities and threats

3. To determine the risk that threats will become a reality and disrupt the operational process

4. To determine a balance between the costs of an incident and the costs of a security measure

Part of the risk analysis is a cost/benefit assessment. The annual costs associated with the security

measures