Mitigating Risks in Information Systems

Threat assessments catalog the landscape of potential threat actors and events that could affect an information system. Think of it as answering: who wants to attack us, what natural or accidental events could cause damage, and how likely are each of these? The output is a prioritized list of threats that feeds into everything downstream — vulnerability scanning, exploit testing, and risk planning.

When discussing tools or methods for threat assessment, consider structured approaches like threat modeling frameworks (STRIDE, MITRE ATT&CK) and threat intelligence platforms or threat cataloging methods like those outlined in NIST SP 800-30. Your paper should explain what makes these appropriate for threat identification specifically — they catalog known threat actors, tactics, and scenarios rather than scanning for technical weaknesses in live systems.

Vulnerability assessments look inward — at the systems you operate — and identify where weaknesses exist. These are passive or semi-active scans. They catalog vulnerabilities but don’t actively try to exploit them. The goal is a prioritized inventory of weaknesses: which ones are most severe, which are easiest to patch, and which pose the highest risk given the threat landscape identified in the previous assessment.

For tools, automated vulnerability scanners are the obvious category. When writing about specific tools or methods, explain the mechanism: a network vulnerability scanner probes live systems for open ports, misconfigured services, and known CVE (Common Vulnerabilities and Exposures) entries. Security configuration review is another method — manually or automatically checking whether systems are hardened against known weaknesses. Frame each tool around what vulnerability assessment is trying to achieve: detection and inventory, not active exploitation.

Exploit assessment — often called penetration testing or ethical hacking — goes one step further than vulnerability scanning. Instead of just identifying weaknesses, it actively attempts to exploit them in a controlled environment to determine their real-world impact. This is the most aggressive form of security assessment and requires specific authorization, defined scope, and qualified personnel.

When discussing tools or methods here, penetration testing frameworks and exploit development platforms fall into this category. Explain why exploit assessment is distinct: it answers “can this vulnerability actually be used to gain unauthorized access or cause harm?” — a question that vulnerability scanning alone can’t answer. For your paper, also note that the results of exploit assessment are particularly valuable for prioritizing remediation: a vulnerability that can be reliably exploited moves to the top of the fix list regardless of its theoretical severity score.

Physical security controls are the layer of protection that operates before someone even touches a keyboard. They govern access to facilities, server rooms, hardware, and the physical infrastructure that information systems run on. The key thing to communicate in your paper is that physical security is not just a building management concern — it’s a critical information security layer. A sophisticated firewall does nothing if an unauthorized person can walk into a server room and pull drives.

When discussing your chosen physical control methods, describe what the control does, what threat or vulnerability it addresses, and then pivot immediately to the personnel. Who installs, monitors, and manages this control? What are their specific responsibilities? A physical security officer and a facilities security manager have different roles even when managing the same type of control. That specificity is what earns marks in this section.

Logical controls — also called technical controls — operate within the information system itself. They govern who can access what, what actions are permitted, and how data is protected in transit and at rest. The distinction from physical controls is important to state clearly in your paper: physical controls protect the hardware and the space it occupies; logical controls protect the data and system functions that run on that hardware. Both layers are required — neither substitutes for the other.

For each logical control you discuss, connect it to a specific personnel role. An identity and access management (IAM) control isn’t implemented by the same person as a network monitoring system, even if both sit in the security department. Information security analysts, network security engineers, systems administrators with security responsibilities — each has a distinct scope. Your paper should draw those lines clearly, not lump “IT security staff” into a catch-all role.

No information system can be made risk-free. The first goal of a risk mitigation plan is to reduce identified risks to a level the organization can accept — a level defined by its risk appetite, regulatory requirements, and operational constraints. This is important to frame correctly in your paper: the goal is not zero risk, it’s acceptable risk. Controls are designed and selected based on how much they reduce either the likelihood of a threat exploiting a vulnerability or the impact if it does.

The practical implication is that risk mitigation plans always involve trade-offs. A more aggressive control reduces more risk but may cost more, create friction for users, or require more personnel to manage. The plan must balance protection against operability. Your paper should name this tension — it’s what makes risk management a strategic function rather than a technical checkbox exercise.

The second primary goal ties back to what information security fundamentally protects. Every mitigation control — whether it’s access management, encryption, network segmentation, or physical access restriction — ultimately serves one or more elements of the CIA triad. Confidentiality means only authorized parties can access data. Integrity means data is accurate and hasn’t been altered without authorization. Availability means systems and data are accessible when needed by authorized users.

For your paper, don’t just define the triad — connect it to the mitigation plan. Explain that the CIA triad gives the organization a framework for evaluating whether a mitigation control is appropriately targeted. A ransomware risk primarily threatens availability and integrity — mitigation controls should be evaluated against their effectiveness at protecting those two properties specifically. That’s the kind of analytical connection that demonstrates you’re applying the concept, not just reciting it.

Using the terms interchangeably — or defining them correctly but then assigning the wrong tools to each — signals that you haven’t fully grasped the distinctions the question is built around. A penetration testing tool is not a threat assessment tool. A network vulnerability scanner is not an exploit assessment tool. Before finalizing your Part 1 draft, check each tool against the definition of the assessment it’s supposed to support. If the tool detects weaknesses rather than actively exploiting them, it belongs in vulnerability assessment, not exploit assessment.

A pattern that comes up repeatedly: strong two-paragraph descriptions of physical and logical controls, followed by a single line — “This would be managed by the IT security team.” That’s not a discussion of roles and responsibilities. The brief explicitly says to “discuss their roles and responsibilities.” That means explaining what those personnel actually do in relation to the control: who configures it, who monitors it, who responds when it triggers, who reports on it to management, and who is responsible for its ongoing maintenance and testing.

A paper that defines each plan in its own paragraph and calls that a comparison hasn’t answered the question. A comparison explains how the two plans relate to each other, where they serve different purposes, and under what conditions each is relevant. The most useful framing: a risk mitigation plan operates before an incident; a contingency plan operates after one. They’re both necessary — the mitigation plan tries to make the contingency plan unnecessary, and the contingency plan is what you fall back on when mitigation wasn’t enough.

Almost every student who covers Part 4 defines confidentiality, integrity, and availability. That’s fine — but it’s not enough. The question asks you to discuss the goals of implementing a risk mitigation plan. The CIA triad is the framework those goals operate within. Your paper should show how specific mitigation controls serve specific CIA properties — not just assert that the triad is important. Encryption protects confidentiality. Hashing and digital signatures protect integrity. Redundancy and failover protect availability. Connect the concepts to the controls.