SSCP · Question #511
Computer security should be first and foremost which of the following:
The correct answer is B. Be cost-effective. Computer security should first and foremost be cost-effective. This is a foundational principle: the cost of implementing a security control should never exceed the value of the asset being protected or the potential loss from the risk. While covering identified risks…
Question
Computer security should be first and foremost which of the following:
Options
- ACover all identified risks
- BBe cost-effective.
- CBe examined in both monetary and non-monetary terms.
- DBe proportionate to the value of IT systems.
How the community answered
(51 responses)- A2% (1)
- B90% (46)
- C2% (1)
- D6% (3)
Explanation
Computer security should first and foremost be cost-effective. This is a foundational principle: the cost of implementing a security control should never exceed the value of the asset being protected or the potential loss from the risk. While covering identified risks, considering non-monetary factors, and proportionality to system value are all valid considerations, none of them matter if the security solution is not cost-effective. A security program that costs more than the losses it prevents is not justifiable to management or stakeholders.
Topics
Community Discussion
No community discussion yet for this question.