Scenario: Devonshire Deluxe $($DD$)$ is the company that a colleague of yours just joined. DD$$s senior management has had a few unsettling weeks after a cyber$-$incident brought them down. Your colleague has asked you to help them perform a Risk Assessment.

Three weeks ago on a Thursday afternoon DD$$s network was brought down by a cyber$-$attack. The attack flooded DD$$s networks with thousands of requests. When the event started there was confusion over who was handling the response and who had information on it$.$ Consequently, the response efforts took longer because different team members were trying to answer questions as they were investigating the event.

DD was unable to identify when the event started because they had no logs to analyze. There was confusion because they did not know if the issue was caused by code a developer put into production or a missing patch. DD was unsure of when patches were applied or even if they were applied. Finally, to make matters worse DD realized that they did not have an accurate or complete listing of their hardware and software.

Purpose of the assessment:

DD has been made aware of multiple risks from both internal and external sources and is performing an internal risk assessment to give senior staff the information and resources they need to make informed decisions on what security controls to implement to mitigate risks to an acceptable level.

a$)$ Describe the purpose of the risk assessment, including questions to be answered by the assessment?

b$)$ Who is the audience for this report?