Ch. 5 – Risk Management

Flashcard maker : Lily Taylor
Risk assessment
The determination of the extent to which an organization’s info assets are exposed to risk and the assignment of a risk rating or score to each information asset. Pg 231
Risk control
The application of controls that reduce the risks to an organization’s info assets to an acceptable level. Pg 231
Risk identification
The ordering and documentation of risks to an organization’s info assets. Pg 231
Risk management
The process of identifying risk, assessing its relative magnitude, and taking steps to reduce it to an acceptable level. Pg 231
Defense, transfer, mitigation, acceptance, and termination
What are the 5 risk control strategies?
False- CBA determines
The computed value of the ALE compares the costs and benefits of a particular control alternative, to determine whether the control is worth it’s cost.
Incident response (IR)
The __________ plan specifies the actions an organization can and should take while an adverse event (that could result in loss of an information asset or assets, but does not currently threaten the viability of the entire organization) is in progress.
Field change order (FCO)
A(n) _________ is an authorization issued by an organization for the repair, modification, or update of a piece of equipment.
To determine if the risk to an information asset is acceptable or not, you estimate the expected loss the organization will incur if the risk is exploited.
__________ is the process of comparing other organizations’ activities against the practices used in one’s own organization to produce results it would like to duplicate.
__________-based measures are comparisons based on observed numerical data, such as numbers of successful attacks.
__________-based measures are performance measures or metrics based on intangible activities.
__________ feasibility analysis examines user acceptance and support, management acceptance and support, and the overall requirements of the organization’s stakeholders.
Exposure factor (EF)
The expected percentage of loss that would occur from a particular attack in a cost-benefit analysis.
Best business practices
__________, often called recommended practices, are security efforts that seek to provide a superior level of performance in the protection of information.
Within data classification schemes, it is important that all categories used be __________ and mutually exclusive.
Cost Benefit Analyses (CBAs) cannot be calculated after controls have been functioning for a time, as observation over time prevents precision in evaluating the benefits of the safeguard and determining whether it is functioning as intended. Pg 273
Operational/behavioral feasibility
__________ is an assessment of user acceptance and support, management acceptance and support, and the overall requirements of the organization’s stakeholders. Pg 283
Organizational feasibility
__________ is an assessment of how well the proposed information security alternatives will contribute to the efficiency, effectiveness, and overall operation of an organization. Pg 283
Technical feasibility
An assessment of whether the organization can acquire the technology necessary to implement and support the proposed control. Pg 283
Political feasibility
An assessment of which controls can and cannot occur based on the consensus and relationships among communities of interest. Pg 283
MAC (media access control)
__________ addresses are sometimes called electronic serial numbers or hardware addresses. All network interface hardware devices have a unique address number as part of the TCP/IP standard.
Not management
Risk _________ is the application of security mechanisms to reduce the risks to an organization’s data and information systems.
The results from risk assessment activities can be delivered in a number of ways: a report on a systematic approach to risk control, a project-based risk assessment, or a topic-specific risk assessment.
DR (disaster recovery)
__________ plans usually include all preparations for the recovery process, strategies to limit losses during the disaster, and detailed steps to follow when the smoke clears, the dust settles, or the floodwaters recede.
Distribution, portability, destruction
Management of classified data includes its storage and __________.
Residual risk is the risk that that has not been removed, shifted, or planned for after vulnerabilities have been completely resolved.
Comprehensive means that all information assets must fit in the list somewhere, and mutually exclusive means that an information asset should fit in only one category.
If the acceptance strategy is used to handle every vulnerability in the organization, its managers may be unable to conduct proactive security activities and portray an apathetic approach to security in general
Baselining is the comparison of past security activities and events against the organization’s current performance. Pg 282
In the early IT days, establishing a competitive business model, method, or technique enabled an organization to provide a product or service that was superior and created a(n) competitive advantage.
Cost __________ ?is the process of preventing the financial impact of an incident by implementing a control.
Security clearance scheme
A __________ is a formal access control methodology used to assign a level of confidentiality to an information asset and thus restrict the number of people who can access it.
The most common mitigation plans are __________ plans.
TVA (threats-vulnerabilities-assets) worksheet
A document that shows a comparative ranking of prioritized assets against prioritized threats, with an indication of any vulnerabilities in the asset/threat pairings.
TVA (threats-vulnerabilities-assets) triplets
A pairing of an asset with a threat and an identification of vulnerabilities that may exist between the two. This pairing is often expressed in the format TxVyAz, where there may be one or more vulnerabilities between Threat X and Asset Z.
Exposure factor
__________ is the expected percentage of loss that would occur from a particular attack.
– Defense control strategy: Attempts to eliminate or reduce any remaining uncontrolled risk through the application of additional controls and safeguards.
– Transfer control strategy: Attempts to shift residual risk to other assets, other processes, or other organizations.
– Mitigation control strategy: attempts to reduce impact of a successful attack through planning and prep
– Acceptance control strategy: Indicates and organization is willing to accept the current level of risk.
– Termination control strategy: eliminates all risk associated with an information asset by removing it from service.
Risk Control Strategies (begins pg. 268)
– Incident Response plan: the actions an organization can & should take whole an incident is in progress.
– Disaster Recovery plan: Most common, includes all prep for the recovery process, strategies to limit loss during a disaster, and detailed steps to follow in aftermath.
– Business Continuity plan: Includes steps necessary to ensure the continuation of the organization when the disaster’s scope or scale exceeds the ability of the DR plan to restore operations, usually through relocation of critical business functions.
Contingency Plans
Cost-Benefit analysis (CBA)
The formal decision making process used when considering the economic feasibility of implementing information security controls and safeguards is called a __________.
Loss frequency
The calculation of the likelihood of an attack multiplied by the attack frequency to determine the expected number of losses within a specified time range is called the __________.
When determining the relative importance of each asset, refer to the organization’s mission statement or statement of objectives to determine which elements are essential, which are supportive, and which are merely adjuncts.
Some information security experts argue that it is virtually impossible to determine the true value of information and information-bearing assets.
__________ is the probability that a specific vulnerability within an organization will be the target of an attack.
A best practice proposed for a small to medium business will be similar to one used to help design control strategies for a large multinational company.
Standards of due care
When organizations adopt security measures for a legal defense, they may need to show that they have done what any prudent organization would do in similar circumstances. This is referred to as __________.
Security clearance scheme
_________ assigns a status level to employees to designate the maximum level of classified data they may access.
Annualized rate of occurrence (ARO)
__________ is simply how often you expect a specific type of attack to occur.
Performance gap
The __________ is the difference between an organization’s observed and desired performance.
Exposure factor
In a cost-benefit analysis, a single loss expectancy (SLE) is the calculated value associated with the most likely loss from an attack, with the SLE being the product of the asset’s value and the __________.
Weighted factor analysis
In a __________, assets or threats can be prioritized by identifying criteria with differing levels of importance, assigning a score for each of the criteria and then summing and ranking those scores.
Identifying human resources, documentation, and data information assets of an organization is __________ difficult than identifying hardware and software assets.
__________ risk is a combined function of (1) a threat less the effect of threat-reducing safeguards, (2) a vulnerability less the effect of vulnerability-reducing safeguards, and (3) an asset less the effect of asset value-reducing safeguards.
Not loss frequency
_________ equals the probability of a successful attack times the expected loss from a successful attack plus an element of uncertainty.
__________ risk assessment is based on categorical or non-numeric values, rather than numbers.
__________ risk assessment is based on numbers.
Risk identfication
__________ is the first phase of risk management.

Get instant access to
all materials

Become a Member