A post-incident review finds that the attacker exploited a weakness that the risk register rated as low likelihood and low impact. What should the security manager do as a result?
Select an answer to reveal the explanation.
Short Explanation
An incident is real-world evidence that your risk map got something wrong. You go back and redraw that part of the map. Ignoring it or panicking and marking everything red are both traps.
Full Explanation
Incidents provide direct evidence about threats, vulnerabilities and impacts, and that evidence should feed back into the risk management process. When an incident exploits a weakness rated as low risk, the assumptions behind that rating, such as threat activity, control effectiveness or business impact, have proved inaccurate. Reassessing the related risks, updating the risk register and revising treatment plans ensures that management decisions, investments and risk acceptance reflect current reality. Similar risks rated with the same assumptions should also be reviewed. Leaving the rating unchanged ignores relevant evidence; while one event does not define a probability, it shows that likelihood and impact estimates need to be revisited. Raising every risk to high overreacts, removes the prioritization the register exists to provide and would misdirect resources. Removing the risk because the incident occurred and was resolved confuses an event with a risk: the weakness, or similar weaknesses, may still exist and the incident may recur. Exam caveat: risk owners, not the security manager alone, should accept the revised ratings and decide on treatment, with the security manager facilitating the analysis. Operational check: confirm the register entry records the incident, the revised assessment, the approving risk owner and any new treatment actions.