10. What are vulnerabilities? How do you identify them?

They are specific avenues that threat agents can exploit to attack an
information asset.
They are chinks in the armor, a flaw or weakness in an information asset,
security procedure, design, or control that could be exploited accidentally or
on purpose to breach security.`

12. What five strategies for controlling risk are described in this chapter?

The defend control strategy

The transfer control strategy

The mitigate control strategy
The accept control strategy
The terminate control strategy

13. Describe the defense strategy for controlling risk. List and describe the
three common
methods.
14. Describe the transfer strategy for controlling risk. Describe how
outsourcing can be
used for this purpose.
15. Describe the mitigation strategy for controlling risk. What three planning
approaches

are discussed in the text as opportunities to mitigate risk?

17. What is risk appetite? Explain why it varies among organizations.

18. What is a cost-benefit analysis?

It determines whether or not a particular control is worth its cost. CBAs may
be calculated before a control or safeguard is implemented to determine if
the control is
worth implementing.

20. What is residual risk?