Using this formula Cyber risk = Threat x Vulnerability x Information Value I wish to make a high-level calculation of the cyber risk in the IT infrastructure for: a hospital with three buildings and 400 beds. It has a Database for patients, a Database for employees and a Database medical and medicine suppliers and also serves as a data storage and long-term archive. Target vulnerability is done by third party not internal. 1. Explain how to Perform an IT Cyber Security Risk Assessment? 2. Explain how to Perform a Security Risk Assessment for the hospital IT system 3. Explain how to do Security Testing and Assessment for the hospital IT system (hint Q3 refers to the NIST guide attached.https://csrc.nist.gov/publications/detail/sp/800-115/final )

.._ _ ........... J. .................................................................................................................. _ 5. Target Vulnerability Validation Techniques .................................................................. 5-1 5.1 Password Cracking .................................................................................................. 5-1 5.2 Penetration Testing .................................................................................................. 5-2 5.2.1 Penetration Testing Phases ......................................................................... 5-2 5.2.2 Penetration Testing Logistics ....................................................................... 5-5 5.3 Social Engineering ................................................................................................... 5-6 5.4 Summary .................................................................................................................. 5-7