Risk Assessment & Risk Strategies | AP Cybersecurity
Cybersecurity Risk Assessment & Risk Strategies Explained
Risk occurs when a threat can exploit a vulnerability to compromise an asset. Topic 2.1 asks you to describe the risk-assessment process and identify strategies for handling risk once it is measured.
Contents
How risk is assessed
Risk exists when a threat can exploit a vulnerability to compromise an asset. An asset is anything valuable: data, money, intellectual property, infrastructure, physical property, or reputation.
Assessment weighs two factors: the likelihood that a vulnerability is exploited and the severity of the resulting attack. High likelihood plus high severity equals high risk.
A server holding customer data has an unpatched flaw that attackers are actively exploiting. Is this high or low risk?
Reveal answer
High risk. The likelihood is high (actively exploited) and the severity is high (customer data is a valuable asset), so both factors point to high risk.
Remember the formula in words: risk rises when a likely exploit meets a severe consequence. Both factors matter, not just one.
The four risk strategies
Once risk is assessed, an organization chooses a response. Avoidance stops the risky activity entirely. Transference shifts the burden to another party, such as insurance. Mitigation implements security controls to reduce the risk.
Whatever is left after a strategy is applied is residual risk, which an organization may choose to accept. Choices are also shaped by cost: you do not spend more protecting an asset than it is worth.
A company buys cyber insurance to cover potential breach costs. Which risk strategy is this?
Reveal answer
Risk transference. The company shifts the financial burden of the risk to the insurer rather than removing or reducing the risk itself.
Why patching is risk-based
Teams cannot fix every flaw at once, so they rank by likelihood times severity: an actively exploited flaw on a critical server is patched before a low-severity one. That ranking is risk assessment driving action.
Both factors matter, not just one.
Key Terms
| Risk | A threat exploiting a vulnerability to compromise an asset. |
| Asset | Anything valuable: data, money, infrastructure, reputation. |
| Mitigation | Reducing risk by adding security controls. |
| Transference | Shifting the risk burden to another party, like insurance. |
| Residual risk | The risk that remains after a strategy is applied. |
Match It Up
Common Mistakes
Judging risk by one factor
Risk needs both likelihood and severity. A severe but near-impossible event is not automatically high risk.
Confusing mitigation with avoidance
Mitigation reduces risk with controls; avoidance stops the activity altogether.
Forgetting residual risk
Controls rarely eliminate risk; what remains is residual risk that may be accepted.
Overspending on low-value assets
Protection should not cost more than the asset is worth.
Check for Understanding
Frequently Asked Questions
Get in Touch
Whether you're a student, parent, or teacher — I'd love to hear from you.
Just want free AP CS resources?
Enter your email below and check the subscribe box — no message needed. Students get daily practice questions and study tips. Teachers get curriculum resources and teaching strategies.
Message Sent!
Thanks for reaching out. I'll get back to you within 24 hours.
Prefer email? Reach me directly at [email protected]