1. If an organization has three information assets to evaluate for risk management as shown in the accompanying data, which vulnerability should be evaluated for additional controls first? Which one should be evaluated last?

An evaluation of the provided asset vulnerabilities results in:

Asset A:

This is a switch that has two vulnerabilities. The first involves a hardware failure likelihood of 2 and the second involves a buffer attack likelihood of 1. The switch has an impact rating of 4.

Asset B:

This is a web server that deals with e-commerce transactions. It has one vulnerability with a likelihood of 1. However it has an impact rating of 5.

Asset C:

This is a control console with no password protection with a likelihood of attack of 1. It has no controls and an impact rating of 1.