Question

1. The unchecked Web application is a risk to the organization hosting the application and the users that rely on the application in their daily lives. The risk of loss is real and no matter how much effort an organization puts into securing their environment, there is always some residual risk. So how should that residual risk be dealt with? Once identified, what step should be taken to deal with the residual risk? (SLO 2, 3, EOs, 2b, 3b)
2. Network based attacks take advantage of vulnerabilities to expose a large number of devices to malicious users. List at least two different types of network attacks, describe what they are and the impact that it has on network users. (SLO 2, 3, EOs, 2b, 3b).

Answer 1

1. In order to deal with the residual risk, we have to, first of all, make the assessment of the risk. This means that we need to, first of all, see whether there would be a big impact due to this risk or not. Eliminating all the risks from the system is not possible. Thus if the risk is meniscal then we can let it remain and there would be no need to handle the risk.
Otherwise following are the ways in which we can handle the residual risk.

1. If the risk is below the acceptable risk level then we can have it in the system.
2. If the risk is above the acceptable risk level then we need to check for the risk and try to find the ways to mitigate the problem.
3. If the risk is above the threshold level and it would be very costly to mitigate the problem and the cost would be greater than the attack then we can let it remain in the system.

Thus above is the way in which we can handle the residual risk.