Which term refers to any process that directly reduces a threat or vulnerability?

Which term refers to any process that directly reduces a threat or vulnerability?

• A. Countermeasure
• B. Disaster recovery
• C. Residual risk
• D. Inherent risk

Answer: (A)

Directly reducing a threat or vulnerability is accomplished by a countermeasure. A countermeasure is any action, control, or process implemented to lower risk by decreasing either the likelihood of a threat exploiting a vulnerability or the potential impact if it does. This is different from disaster recovery, which focuses on restoring operations after an incident rather than reducing the threat itself. It’s also distinct from residual risk, which is the amount of risk that remains after controls are in place, and inherent risk, which is the level of risk before any controls are applied. In practice, countermeasures include patches, access controls, encryption, security monitoring, and user awareness training, all aimed at reducing risk at the source.

Directly reducing a threat or vulnerability is accomplished by a countermeasure. A countermeasure is any action, control, or process implemented to lower risk by decreasing either the likelihood of a threat exploiting a vulnerability or the potential impact if it does. This is different from disaster recovery, which focuses on restoring operations after an incident rather than reducing the threat itself. It’s also distinct from residual risk, which is the amount of risk that remains after controls are in place, and inherent risk, which is the level of risk before any controls are applied. In practice, countermeasures include patches, access controls, encryption, security monitoring, and user awareness training, all aimed at reducing risk at the source.