Neco 2019 Computer Studies Question 6

A small enterprise maintains the following assets and their monetary values: - Customer database: ₦5,000,000 (impact factor High = 3) - Financial records: ₦2,000,000 (impact factor Medium = 2) - Server hardware: ₦1,500,000 (impact factor Low = 1) The company has identified three primary threats and their likelihood of occurrence in a year: - Malware infection (likelihood 0.3) - Insider data theft (likelihood 0.1) - Power outage (likelihood 0.2) Corresponding vulnerabilities are: - No anti‑virus software (relevant to malware) - Weak password policy (relevant to insider theft) - No UPS (relevant to power outage) Risk for a threat‑asset pair is calculated as: Risk = Likelihood × Impact factor × Asset value (in millions of naira). Answer the following: (a) Compute the risk score for each threat‑asset combination. Present the results in a table. (b) Identify the combination with the highest risk score and state its value. (c) Recommend two technical controls and one administrative control that would reduce the highest risk. (d) Discuss one ethical issue that arises when the organisation decides to monitor employee e‑mail traffic as part of its security strategy.