What type of risk management strategy is being employed when an organization installs two firewalls to provide protection from unauthorized access to the network?

Installing two firewalls is a risk mitigation strategy that employs redundancy. This approach, described as "diversifying," is designed to reduce the risk of a single point of failure. If one firewall fails or is compromised, the other can continue to provide protection and maintain network connectivity. This ensures that the risk of network access becoming unavailable to legitimate, authorized users is significantly reduced. While the primary purpose of a firewall is to prevent unauthorized access, the use of two devices specifically addresses the risk of service interruption and enhances system availability and resilience.

B. Accepting the risk would mean taking no action to counter it. Installing firewalls is an active control measure, which is the opposite of risk acceptance.
C. The organization is actively connecting to untrusted networks, which is why firewalls are needed. Avoiding the risk would mean not establishing the connection at all.
D. Sharing the risk involves transferring the financial impact to a third party, such as through insurance or outsourcing. Installing internal controls is a form of risk mitigation, not sharing. ---

1. The Institute of Internal Auditors (IIA), GTAG 1: Information Technology Risk and Controls, 2nd Edition, 2012.

Page 12, "Risk Response": This section outlines the four primary risk responses: avoidance, reduction (mitigation), sharing (transfer), and acceptance. Implementing controls like firewalls is a classic example of risk reduction. The use of redundant components is a specific technique for risk reduction that enhances system availability.

2. COSO, "Enterprise Risk Management — Integrating with Strategy and Performance," June 2017.

Page 51, "Responses to Risk": The framework describes "Reduce" as an action taken to reduce the severity (impact and/or likelihood) of a risk. Implementing redundant systems like dual firewalls is a direct action to reduce the impact of a component failure, thus reducing overall operational risk.

3. NIST Special Publication 800-34 Rev. 1, "Contingency Planning Guide for Federal Information Systems," May 2010.

Section 3.3.1, "Redundant Systems": This guide explicitly states, "Redundant system components can be used to reduce the likelihood of a single point of failure. For example, an organization may deploy a redundant firewall... to ensure that network traffic is always protected and available." This directly supports that redundancy (two firewalls) is a strategy to ensure availability for users.