A business requires a legacy version of an application to operate but the application cannot be patched. To limit the risk exposure to the business…

Risk mitigation (or reduction) is the application of controls to reduce the likelihood or impact of a risk to an acceptable level. In this scenario, the organization acknowledges the risk posed by the unpatchable legacy application. Instead of eliminating the application (avoidance) or doing nothing (acceptance), they implement a firewall. The firewall acts as a security control to protect the vulnerable application, thereby reducing the probability of a successful attack. This action directly aligns with the definition of risk mitigation.

B. Accept: Risk acceptance involves a formal decision to do nothing about an identified risk. Implementing a firewall is a proactive control, not inaction.

C. Transfer: Risk transfer shifts the financial consequences of a risk to a third party, typically through insurance or outsourcing, which is not what a firewall does.

D. Avoid: Risk avoidance means ceasing the activity that creates the risk. In this case, it would mean decommissioning the legacy application, which contradicts the business requirement.

1. ISACA

CISM Review Manual

15th Edition. Domain 2: Information Risk Management

Section 2.5

"Risk Response." The manual defines risk mitigation as "the application of controls to reduce the risk." The implementation of a firewall is a classic example of such a control.

2. National Institute of Standards and Technology (NIST)

Special Publication (SP) 800-37

Revision 2

"Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy." Section 2.5

"Risk Response

" page 19. This foundational document states that risk mitigation involves implementing "risk-reducing measures" such as controls to protect a system

which directly corresponds to using a firewall to protect a vulnerable application.

3. Peltier

T. R. (2016). Information Security Risk Analysis

Third Edition. Auerbach Publications. Chapter 6

"Risk Mitigation." This academic text explains that risk mitigation strategies involve implementing controls to reduce vulnerabilities or block threats. A firewall is a primary example of a control used to block threats from reaching a vulnerable system. (DOI: https://doi.org/10.1201/9781315371165)