In MDC3, how is a security risk assessment conducted?

• A. Identify security vulnerabilities but skip likelihood assessment.
• B. Only test passwords.
• C. Rely on external audits alone.
• D. Explain how to conduct a security risk assessment by identifying assets, threats, vulnerabilities; evaluating likelihood and impact; proposing mitigations and monitoring residual risk.

Answer: (D)

A security risk assessment in MDC3 is a structured process that starts by identifying what needs protection (assets), what could threaten those assets (threats), and where weaknesses exist (vulnerabilities). Then it rates how likely those threats are and the potential impact if they occur, so the overall risk can be understood. After that, it proposes practical mitigations to reduce risk and sets up monitoring of the remaining risk (residual risk). This approach emphasizes a full cycle: identify, assess likelihood and impact, implement controls, and continuously monitor and adjust as assets or threats change.

This is more comprehensive than focusing only on one piece. Merely identifying vulnerabilities without considering likelihood and impact makes it hard to prioritize actions. Narrowly testing passwords misses other critical threats and weaknesses. Relying on external audits alone neglects internal context and ongoing monitoring, which are essential for managing risk over time.