The Security Management Process includes risk analysis, risk management, risk prevention, and system activity review. Which is a core activity to identify vulnerabilities?

The Security Management Process includes risk analysis, risk management, risk prevention, and system activity review. Which is a core activity to identify vulnerabilities?

• A. System rollout planning
• B. Asset lifecycle management
• C. Risk analysis
• D. Physical security audits

Answer: (C)

Focusing on identifying weaknesses in the system, risk analysis examines what could go wrong, what assets need protection, and where vulnerabilities lie. It systematically looks at threats, vulnerabilities, and potential impacts to determine where controls are needed and how severe a risk could be. This thorough identification of weaknesses is what drives prioritization of defenses and corrective actions, making it the core activity for revealing vulnerabilities within the Security Management Process. System rollout planning is about deploying new systems and features, not about uncovering weaknesses in existing controls. Asset lifecycle management centers on tracking and maintaining assets over time, which is important but not primarily aimed at identifying security vulnerabilities. Physical security audits assess protections against physical threats but focus on physical controls rather than the comprehensive identification of system-wide vulnerabilities. System activity review monitors ongoing use and detects anomalies after the fact, rather than proactively identifying where vulnerabilities exist.

Focusing on identifying weaknesses in the system, risk analysis examines what could go wrong, what assets need protection, and where vulnerabilities lie. It systematically looks at threats, vulnerabilities, and potential impacts to determine where controls are needed and how severe a risk could be. This thorough identification of weaknesses is what drives prioritization of defenses and corrective actions, making it the core activity for revealing vulnerabilities within the Security Management Process.

System rollout planning is about deploying new systems and features, not about uncovering weaknesses in existing controls. Asset lifecycle management centers on tracking and maintaining assets over time, which is important but not primarily aimed at identifying security vulnerabilities. Physical security audits assess protections against physical threats but focus on physical controls rather than the comprehensive identification of system-wide vulnerabilities. System activity review monitors ongoing use and detects anomalies after the fact, rather than proactively identifying where vulnerabilities exist.