Ch. 5 – Risk Management

question

Risk assessment
answer

The determination of the extent to which an organization’s info assets are exposed to risk and the assignment of a risk rating or score to each information asset. Pg 231
question

Risk control
answer

The application of controls that reduce the risks to an organization’s info assets to an acceptable level. Pg 231
question

Risk identification
answer

The ordering and documentation of risks to an organization’s info assets. Pg 231
question

Risk management
answer

The process of identifying risk, assessing its relative magnitude, and taking steps to reduce it to an acceptable level. Pg 231
question

Defense, transfer, mitigation, acceptance, and termination
answer

What are the 5 risk control strategies?
question

False- CBA determines
answer

The computed value of the ALE compares the costs and benefits of a particular control alternative, to determine whether the control is worth it’s cost.
question

Incident response (IR)
answer

The __________ plan specifies the actions an organization can and should take while an adverse event (that could result in loss of an information asset or assets, but does not currently threaten the viability of the entire organization) is in progress.
question

Field change order (FCO)
answer

A(n) _________ is an authorization issued by an organization for the repair, modification, or update of a piece of equipment.
question

True
answer

To determine if the risk to an information asset is acceptable or not, you estimate the expected loss the organization will incur if the risk is exploited.
question

Benchmarking
answer

__________ is the process of comparing other organizations’ activities against the practices used in one’s own organization to produce results it would like to duplicate.
question

Metrics
answer

__________-based measures are comparisons based on observed numerical data, such as numbers of successful attacks.
question

Process
answer

__________-based measures are performance measures or metrics based on intangible activities.
question

Operational
answer

__________ feasibility analysis examines user acceptance and support, management acceptance and support, and the overall requirements of the organization’s stakeholders.
question

Exposure factor (EF)
answer

The expected percentage of loss that would occur from a particular attack in a cost-benefit analysis.
question

Best business practices
answer

__________, often called recommended practices, are security efforts that seek to provide a superior level of performance in the protection of information.
question

Comprehensive
answer

Within data classification schemes, it is important that all categories used be __________ and mutually exclusive.
question

False
answer

Cost Benefit Analyses (CBAs) cannot be calculated after controls have been functioning for a time, as observation over time prevents precision in evaluating the benefits of the safeguard and determining whether it is functioning as intended. Pg 273
question

Operational/behavioral feasibility
answer

__________ is an assessment of user acceptance and support, management acceptance and support, and the overall requirements of the organization’s stakeholders. Pg 283
question

Organizational feasibility
answer

__________ is an assessment of how well the proposed information security alternatives will contribute to the efficiency, effectiveness, and overall operation of an organization. Pg 283
question

Technical feasibility
answer

An assessment of whether the organization can acquire the technology necessary to implement and support the proposed control. Pg 283
question

Political feasibility
answer

An assessment of which controls can and cannot occur based on the consensus and relationships among communities of interest. Pg 283
question

MAC (media access control)
answer

__________ addresses are sometimes called electronic serial numbers or hardware addresses. All network interface hardware devices have a unique address number as part of the TCP/IP standard.
question

Not management
answer

Risk _________ is the application of security mechanisms to reduce the risks to an organization’s data and information systems.
question

True
answer

The results from risk assessment activities can be delivered in a number of ways: a report on a systematic approach to risk control, a project-based risk assessment, or a topic-specific risk assessment.
question

DR (disaster recovery)
answer

__________ plans usually include all preparations for the recovery process, strategies to limit losses during the disaster, and detailed steps to follow when the smoke clears, the dust settles, or the floodwaters recede.
question

Distribution, portability, destruction
answer

Management of classified data includes its storage and __________.
question

False
answer

Residual risk is the risk that that has not been removed, shifted, or planned for after vulnerabilities have been completely resolved.
question

True
answer

Comprehensive means that all information assets must fit in the list somewhere, and mutually exclusive means that an information asset should fit in only one category.
question

True
answer

If the acceptance strategy is used to handle every vulnerability in the organization, its managers may be unable to conduct proactive security activities and portray an apathetic approach to security in general
question

True
answer

Baselining is the comparison of past security activities and events against the organization’s current performance. Pg 282
question

True
answer

In the early IT days, establishing a competitive business model, method, or technique enabled an organization to provide a product or service that was superior and created a(n) competitive advantage.
question

Avoidance
answer

Cost __________ ?is the process of preventing the financial impact of an incident by implementing a control.
question

Security clearance scheme
answer

A __________ is a formal access control methodology used to assign a level of confidentiality to an information asset and thus restrict the number of people who can access it.
question

Contingency
answer

The most common mitigation plans are __________ plans.
question

TVA (threats-vulnerabilities-assets) worksheet
answer

A document that shows a comparative ranking of prioritized assets against prioritized threats, with an indication of any vulnerabilities in the asset/threat pairings.
question

TVA (threats-vulnerabilities-assets) triplets
answer

A pairing of an asset with a threat and an identification of vulnerabilities that may exist between the two. This pairing is often expressed in the format TxVyAz, where there may be one or more vulnerabilities between Threat X and Asset Z.
question

Exposure factor
answer

__________ is the expected percentage of loss that would occur from a particular attack.
question

– Defense control strategy: Attempts to eliminate or reduce any remaining uncontrolled risk through the application of additional controls and safeguards. – Transfer control strategy: Attempts to shift residual risk to other assets, other processes, or other organizations. – Mitigation control strategy: attempts to reduce impact of a successful attack through planning and prep – Acceptance control strategy: Indicates and organization is willing to accept the current level of risk. – Termination control strategy: eliminates all risk associated with an information asset by removing it from service.
answer

Risk Control Strategies (begins pg. 268)
question

– Incident Response plan: the actions an organization can & should take whole an incident is in progress. – Disaster Recovery plan: Most common, includes all prep for the recovery process, strategies to limit loss during a disaster, and detailed steps to follow in aftermath. – Business Continuity plan: Includes steps necessary to ensure the continuation of the organization when the disaster’s scope or scale exceeds the ability of the DR plan to restore operations, usually through relocation of critical business functions.
answer

Contingency Plans
question

Cost-Benefit analysis (CBA)
answer

The formal decision making process used when considering the economic feasibility of implementing information security controls and safeguards is called a __________.
question

Loss frequency
answer

The calculation of the likelihood of an attack multiplied by the attack frequency to determine the expected number of losses within a specified time range is called the __________.
question

True
answer

When determining the relative importance of each asset, refer to the organization’s mission statement or statement of objectives to determine which elements are essential, which are supportive, and which are merely adjuncts.
question

True
answer

Some information security experts argue that it is virtually impossible to determine the true value of information and information-bearing assets.
question

Likelihood
answer

__________ is the probability that a specific vulnerability within an organization will be the target of an attack.
question

False
answer

A best practice proposed for a small to medium business will be similar to one used to help design control strategies for a large multinational company.
question

Standards of due care
answer

When organizations adopt security measures for a legal defense, they may need to show that they have done what any prudent organization would do in similar circumstances. This is referred to as __________.
question

Security clearance scheme
answer

_________ assigns a status level to employees to designate the maximum level of classified data they may access.
question

Annualized rate of occurrence (ARO)
answer

__________ is simply how often you expect a specific type of attack to occur.
question

Performance gap
answer

The __________ is the difference between an organization’s observed and desired performance.
question

Exposure factor
answer

In a cost-benefit analysis, a single loss expectancy (SLE) is the calculated value associated with the most likely loss from an attack, with the SLE being the product of the asset’s value and the __________.
question

Weighted factor analysis
answer

In a __________, assets or threats can be prioritized by identifying criteria with differing levels of importance, assigning a score for each of the criteria and then summing and ranking those scores.
question

More
answer

Identifying human resources, documentation, and data information assets of an organization is __________ difficult than identifying hardware and software assets.
question

Residual
answer

__________ risk is a combined function of (1) a threat less the effect of threat-reducing safeguards, (2) a vulnerability less the effect of vulnerability-reducing safeguards, and (3) an asset less the effect of asset value-reducing safeguards.
question

Not loss frequency
answer

_________ equals the probability of a successful attack times the expected loss from a successful attack plus an element of uncertainty.
question

Qualitative
answer

__________ risk assessment is based on categorical or non-numeric values, rather than numbers.
question

Quantitative
answer

__________ risk assessment is based on numbers.
question

Risk identfication
answer

__________ is the first phase of risk management.

Get instant access to
all materials

Become a Member