The senior managers decide to perform a security assessment to understand its risk in this area. An outside consulting firm is hired to evaluate the enterprise s security. There are no back doors into the network. The number of accounts on most servers is limited. Most servers are accessed remotely.
Authentication is required when users access servers.
The consultants failed to develop a picture of the risk facing the enterprise. Consequently, senior managers believed that the financial information was secure, based on the results of the assessment. They felt safe from the threat of outsiders breaking into their network and stealing sensitive financial information. They were not considering other potential threats. Personnel from senior management, middle management, and staff levels participated in the risk evaluation.