CRISC · Question #518
Which of the following is MOST important to consider when assessing the likelihood that a recently discovered software vulnerability will be exploited?
The correct answer is A. The skill level required of a threat actor. When assessing the likelihood of a software vulnerability being exploited, the most important factor is the skill level required by a threat actor. Lower skill requirements increase the pool of potential attackers and thus the likelihood of exploitation.
Question
Which of the following is MOST important to consider when assessing the likelihood that a recently discovered software vulnerability will be exploited?
Options
- AThe skill level required of a threat actor
- BThe amount of personally identifiable information (PH) disclosed
- CThe ability to detect and trace the threat action
- DThe amount of data that might be exposed by a threat action
How the community answered
(20 responses)- A80% (16)
- B5% (1)
- C10% (2)
- D5% (1)
Why each option
When assessing the likelihood of a software vulnerability being exploited, the most important factor is the skill level required by a threat actor. Lower skill requirements increase the pool of potential attackers and thus the likelihood of exploitation.
The skill level required by a threat actor directly impacts the ease and accessibility of exploiting a vulnerability. If a vulnerability requires low skill or readily available tools, the likelihood of exploitation significantly increases because a broader range of malicious actors can exploit it.
The amount of PII disclosed relates to the *impact* of an exploit, not its likelihood.
The ability to detect and trace an action relates to incident response and post-exploitation, not the likelihood of the initial exploitation.
The amount of data exposed relates to the *impact* of an exploit, not the likelihood of it occurring.
Concept tested: Risk likelihood factors (vulnerability exploitation)
Topics
Community Discussion
No community discussion yet for this question.