What is the primary function of risk analysis?

• A. Identify threats only and ignore asset value.
• B. Identify valuable system resources and threats; quantify loss exposures based on estimated frequencies and costs of occurrence; and optionally recommend how to allocate resources to countermeasures so as to minimize total exposure.
• C. Monitor network traffic to detect intrusions.
• D. Implement automatic countermeasures without assessment.

Answer: (B)

Risk analysis aims to understand what could be lost and how likely it is, so you can prioritize protection. It involves identifying the valuable system resources, recognizing the threats to those resources, and assessing vulnerabilities. Then you estimate loss exposures by considering how often incidents might occur and what their costs would be. This information lets you decide where to allocate resources to countermeasures to minimize overall exposure. The best option captures all of that: it identifies valuable resources and threats, quantifies loss exposures based on estimated frequencies and costs, and can guide how to allocate protections to reduce total risk. By contrast, simply identifying threats without valuing assets, monitoring only for intrusions, or implementing automatic countermeasures without assessment miss essential parts of the risk-analysis process.