A city finance clerk and a wastewater historian both need scores from new RBA content. How should the risk objects be typed?
Select an answer to reveal the explanation.
Short Explanation
A clerk is a person and a historian is a box. Risk scores stick to the thing that actually did the deed. Mix those types and the next notable will blame the wrong neighbor.
Full Explanation
The Enterprise Security risk framework attaches a numeric score to a risk object that is typically a user or a system. Identity-centric activity such as a finance clerk logon should increment a user object; host-centric activity on a SCADA historian should increment a system object. Collapsing both into one type, or scoring the search name instead of the entity, breaks aggregation and the risk-notable story. Analysts must request the object type that matches the civic entity being scored.