Which assessment type focuses on all types of user risks, including threats from malicious users, ignorant users, vendors, and administrators?

Which assessment type focuses on all types of user risks, including threats from malicious users, ignorant users, vendors, and administrators?

• A. Network-based assessment
• B. Insider threat assessment
• C. Physical security assessment
• D. Host-based assessment

Answer: (D)

Insider threat assessment focuses on risks from people who have authorized access to systems, including malicious insiders, negligent or ignorant users, vendors, and administrators. This type of assessment examines how privileges are granted and monitored, how access is controlled, and how policies, training, and technical controls mitigate abuse by those within the organization or trusted partners. It captures the broad spectrum of user-driven risks—from deliberate misconduct to simple human error—that can compromise security. The other assessments center on different areas: network-based looks at vulnerabilities across the network infrastructure; physical security evaluates protection against physical access and environmental threats; and host-based targets a single machine’s configuration and security controls, not the wider range of user-originated risks.

Insider threat assessment focuses on risks from people who have authorized access to systems, including malicious insiders, negligent or ignorant users, vendors, and administrators. This type of assessment examines how privileges are granted and monitored, how access is controlled, and how policies, training, and technical controls mitigate abuse by those within the organization or trusted partners. It captures the broad spectrum of user-driven risks—from deliberate misconduct to simple human error—that can compromise security.

The other assessments center on different areas: network-based looks at vulnerabilities across the network infrastructure; physical security evaluates protection against physical access and environmental threats; and host-based targets a single machine’s configuration and security controls, not the wider range of user-originated risks.