(Which lesson can be learned from organizations that experience breaches due to poor cryptographic practices?)

Breaches resulting from poor cryptographic practices, such as using weak algorithms, hardcoded keys, or improper key storage, are fundamentally failures in risk management. A comprehensive risk assessment is the formal process for identifying, analyzing, and evaluating such risks. The key lesson from these breaches is the critical importance of proactively conducting these assessments to discover cryptographic vulnerabilities and other weaknesses before they can be exploited by attackers. This allows an organization to prioritize and apply appropriate controls to mitigate the identified risks, thereby preventing potential breaches.

B. Many cryptographic failures stem from human error, making employee training on secure practices highly relevant and necessary.

C. The lesson is the opposite; breaches often occur because systems were not regularly audited or updated to fix known vulnerabilities.

D. This mindset is a cause of breaches; the lesson is that integrating security with business objectives is essential for long-term viability.

1. National Institute of Standards and Technology (NIST). (2012). NIST Special Publication 800-30 Revision 1: Guide for Conducting Risk Assessments. Section 2.1, "Purpose and Applicability," p. 4, states that risk assessments are a key component in "making risk-based decisions to protect information and information systems."

2. Goel, S., & Chen, V. (2005). Information security: The role of risk analysis. In Proceedings of the 2nd annual conference on Information security curriculum development (InfoSecCD '05). Association for Computing Machinery, New York, NY, USA, 134–137. https://doi.org/10.1145/1107622.1107655. (This academic paper highlights risk analysis as foundational to information security).

3. Bauer, L. (2017). 15-330/630: Introduction to Computer Security, Fall 2017 Course Notes. Carnegie Mellon University. Lecture 1, "Intro, Threat Models, and Risk Management," pp. 10-12, introduces risk analysis as the process of identifying assets, threats, and vulnerabilities to decide which countermeasures to deploy.