A company's risk assessment process can consider numerous threats to the computers and networks. Which of the following should an organization identify as loss events or threats to assess?

distributed denial$-$of$-$service attack

email attachment with harmful worm

harmful virus

all of the above