Gce Model Questions Vol1 2018 Computer Studies Question 33

A small company has three assets with the following values (on a scale of 1-10): Server = 8, Database = 7, Workstation = 5. Three threats are identified with likelihood scores (1-5): Malware = 4, Insider = 2, DDoS = 3. The relevant vulnerabilities and their severity scores (1-5) are: - Unpatched OS (severity 5) - affects Server and Workstation - Weak passwords (severity 3) - affects Server and Database - No firewall (severity 4) - affects Server only Risk for a particular asset‑threat‑vulnerability combination is calculated as: \[\text{Risk}=\text{Likelihood}\times\text{Severity}\times\text{Asset\ value}\] (a) Compute the total risk for each asset and identify which asset has the highest total risk. (b) The following mitigation options are available (cost in budget units, new severity shown in parentheses): - Patch OS (cost 2, severity 1 for Unpatched OS) - Enforce strong passwords (cost 3, severity 1 for Weak passwords) - Install firewall (cost 4, severity 1 for No firewall) The security budget is 6 units. Choose a set of mitigations that reduces the highest‑risk asset's total risk by at least 30 % while staying within budget. State the chosen mitigations and the resulting risk reduction percentage.