What can be best defined as the examination of threat sources against system vulnerabilities to determine the threats for a particular system in a particular operational environment? 

Answer options:

A. Risk management
B. Risk analysis
C. Threat analysis
D. Due diligence

C

Threat analysis is the examination of threat sources against system vulnerabilities to determine the threats for a particular system in a particular operational environment. The following answers are incorrect: Risk analysis is the process of identifying the risks to system security and determining the probability of occurrence, the resulting impact, and the additional safeguards that mitigate this impact. Risk analysis is synonymous with risk assessment and part of risk management, which is the ongoing process of assessing the risk to mission/business as part of a risk-based approach used to determine adequate security for a system by analyzing the threats and vulnerabilities and selecting appropriate, cost-effective controls to achieve and maintain an acceptable level or risk. Due Diligence is identifying possible risks that could affect a company based on best practices and standards. Reference(s) used for this question: STONEBURNER, Gary & al, National Institute of Standards and Technology (NIST), NIST Special Publication 800-27, Engineering Principles for Information Technology Security (A Baseline for Achieving Security), June 2001 (page B-3).