Which of the following statements are true about security risks? Each correct answer represents a complete solution. Choose three.

A.
They can be analyzed and measured by the risk analysis process.

B.
They are considered an indicator of threats coupled with vulnerability.

C.
They can be removed completely by taking proper actions.

D.
They can be mitigated by reviewing and taking responsible actions based on possible risks.

Explanation:

In information security, security risks are considered an indicator of threats coupled with vulnerability. In other words, security risk is a probabilistic function of a given threat agent exercising a particular vulnerability and the impact of that risk on the organization. Security risks can be mitigated by reviewing and taking responsible actions based on possible risks. These risks can be analyzed and measured by the risk analysis process.

Answer option C is incorrect. Security risks can never be removed completely but can be mitigated by taking proper actions.