Section: Protection of Information Assets

Choice A takes into consideration the likelihood and magnitude of the impact and provides the best measure of the risk to an asset. Choice B provides only the likelihood of a threat exploiting a vulnerability in the asset but does not provide the magnitude of the possible damage to the asset. Similarly, choice C considers only the magnitude of the damage and not the possibility of a threat exploiting a vulnerability. Choice D defines the risk on an arbitrary basis and is not suitable for a scientific risk management process.

Section: Protection of Information Assets
Explanation
Explanation:
Physical security is meant to control who is entering a secured area, so identification of all individuals is of
utmost importance. It is not adequate to trust unknown external people by allowing them to write down their
alleged name without proof, e.g., identity card, driver's license. Choice B is not a concern because if the
name and address of the organization was written on the card, a malicious finder could use the card to
enter the organization's premises. Separating card issuance from technical rights management is a
method to ensure a proper segregation of duties so that no single person can produce a functioning card
for a restricted area within the organization's premises. Choices B and C are good practices, not concerns.
Choice D may be a concern, but not as important since a system failure of the card programming device
would normally not mean that the readers do not function anymore. It simply means that no new cards can
be issued, so this option is minor compared to the threat of improper identification.