Neco 2022 Data Processing Question 28

Consider the following risk assessment for three information assets in a company. | Asset | Threat | Likelihood (1-5) | Impact (1-5) | |-------|--------|------------------|--------------| | A - Customer data | Malware infection (T1) | 4 | 5 | | A - Customer data | Insider theft (T2) | 2 | 5 | | B - Company website | DDoS attack (T3) | 3 | 4 | | B - Company website | Defacement (T4) | 2 | 3 | | C - Financial records | Ransomware (T5) | 3 | 5 | | C - Financial records | Data loss (T6) | 2 | 4 | The risk score for each threat is the product of its likelihood and impact. (a) Compute the risk score for each listed threat and identify the two highest‑scoring risks. (b) For each of those two risks, recommend one technical control that directly addresses the dominant security objective (confidentiality, integrity or availability).