Mitigation measures for threats, vulnerabilities and risks

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. A developer's laptop is infected by malware delivered through a phishing email. Which mitigation measure best matches this risk?

A Staff phishing awareness training combined with email filtering

B Adding more comments to the source code

2. Which statement about a mitigation measure is correct?

A It guarantees that a system can never be attacked

B It reduces or eliminates a specific threat, vulnerability or risk

3. A team stops running an old, unused admin web page that has known flaws. Is this reducing or eliminating the risk?

A Eliminating the risk, because the vulnerable page no longer exists

B Reducing the risk, because the vulnerable page still exists but is harder to reach

4. Which of these is a TECHNICAL mitigation measure for weak passwords?

A Running a one-hour staff induction session

B Enforcing multi-factor authentication on all accounts

5. Which of these is a PROCESS mitigation measure for insecure code reaching production?

A Requiring a peer code review before any code is merged

B Installing antivirus software on the web server

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1mitigation measure		ARequire a peer code review before every merge
2technical measure		BRun regular phishing awareness training for all developers
3A people measure that reduces the risk of staff being tricked by phishing emails		CA future plan does not eliminate the risk. Only applying the patch removes the vulnerability. A schedule at best reduces the risk.
4A process measure that reduces the risk of a vulnerability reaching production code		DA mitigation built into software or systems, such as MFA, encryption or patching
5Risk: stolen passwords. Mitigation: install a new monitor for each developer		EAn action that reduces or eliminates a specific threat, vulnerability or risk
6Risk: unpatched software. Mitigation: eliminated because we plan to patch it next year		FThe measure does not match the risk. A monitor does nothing about stolen passwords. MFA or a password policy should be used.

Definitions

mitigation measure

Fill in the Blanks

Complete each line of code by filling in the missing parts.

Risk: SQL injection Mitigation: ________________ Type: technical

Risk: unused admin account Mitigation: delete the account Effect: _________

Risk: unreviewed code Mitigation: peer code review Type: _______

Risk: staff fall for phishing Mitigation: security training Type: ______

Risk: stolen password Mitigation: add ___ Effect: reduce

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A risk = "SQL injection"

B measure = "buy more storage"

C kind = "technical"

D print(risk, measure, kind)

Question 2

A def pick(risk):

B if risk = "phishing":

C return "train staff"

D return "review risk"

Question 3

A plan = {"SQLi": "validation"}

B risk = "SQLi"

C measure = plan[risk]

D print("Apply:", risk)

Question 4

A kind = "technical"

B measure = "phishing training"

C print(kind, measure)

Question 5

A plan = {

B "phishing": "training",

C "malware" = "antivirus",

D "weak passwords": "MFA"

E }

Answer Key

Mitigation measures for threats, vulnerabilities and risks

Section A: Quick Questions

A — Staff phishing awareness training combined with email filtering

B — It reduces or eliminates a specific threat, vulnerability or risk

A — Eliminating the risk, because the vulnerable page no longer exists

B — Enforcing multi-factor authentication on all accounts

A — Requiring a peer code review before any code is merged

Section B: Match the Pairs

mitigation measure → An action that reduces or eliminates a specific threat, vulnerability or risk

technical measure → A mitigation built into software or systems, such as MFA, encryption or patching

A people measure that reduces the risk of staff being tricked by phishing emails → Run regular phishing awareness training for all developers

A process measure that reduces the risk of a vulnerability reaching production code → Require a peer code review before every merge

Risk: stolen passwords. Mitigation: install a new monitor for each developer → The measure does not match the risk. A monitor does nothing about stolen passwords. MFA or a password policy should be used.

Risk: unpatched software. Mitigation: eliminated because we plan to patch it next year → A future plan does not eliminate the risk. Only applying the patch removes the vulnerability. A schedule at best reduces the risk.

Section C: Definitions

mitigation measure — An action that reduces or eliminates a specific threat, vulnerability or risk, such as a technical, process or people control matched to the risk it addresses.

Section D: Fill in the Blanks

Risk: SQL injection
Mitigation: input validation
Type: technical

Risk: unused admin account
Mitigation: delete the account
Effect: eliminate

Risk: unreviewed code
Mitigation: peer code review
Type: process

Risk: staff fall for phishing
Mitigation: security training
Type: people

Risk: stolen password
Mitigation: add MFA
Effect: reduce

Section E: Spot the Error

B — A measure must match the risk it addresses. More storage does nothing about SQL injection. It should be a control such as validating input or using parameterised queries.

B — A single = assigns a value, but the condition needs a comparison. It should be if risk == "phishing":.

D — The program should show the chosen mitigation measure, not the risk. It should print measure so the student sees which control to apply.

A — Training staff is a people measure, not a technical one. The first line should be kind = "people".

C — Dictionary entries pair a key and a value with a colon, not =. The line should be "malware": "antivirus",