Quiz Entry - updated: 2026.07.14
What are the four ways to address threats in mitigation?
Redesign to eliminate it, apply a standard mitigation, invent a new one, or accept the risk — in that order of preference.
The four options, in order of preference:
| Priority | Approach | Risk Level |
|---|---|---|
| 1st | Redesign to eliminate | Lowest - threat gone |
| 2nd | Apply standard mitigations | Low - proven solutions |
| 3rd | Invent new mitigations | High - untested |
| 4th | Accept the vulnerability | Variable - documented risk |
Examples:
- Eliminate: Remove unused feature that has attack surface
- Standard: Use prepared statements for SQL (proven fix for injection)
- Invent: Custom protocol for unique requirement (risky!)
- Accept: Low-impact threat with expensive fix (needs sign-off)
Rule: Never invent when standard solutions exist. Accepting risk requires management approval and documentation.