10: 2 Risk Management Flashcards
(47 cards)
Risk Management
Systematically Analyzing potential responses to each risk and implementing strategies to control those risks appropriately
Risk Management Strategies (4)
Avoidance, Transference, Mitigation, or Acceptance
Risk Avoidance
Change the organization’s business practice so risk can no longer affect business
Risk Transference
Shifting impact of risk to another organization (i.e. insurance)
Risk Mitigation
Reduces likelihood or impact of risk
Risk Acceptance
Accept risk without taking further action
Risk Profile
Full set of risks facing an organization
Inherent Risk
Risk that exists without any controls in place
Residual Risk
Risk that exists after a control has been implemented
Control Risk
Risk added by adding a control
Security Controls
Procedures and mechanisms that an organization puts in place to manage security risks
Defense in Depth
More than 1 control used to protect against one objective
Preventitive Control
Goal is to stop an issue from occurring in the first place (firewall)
Detective Control
Identify that a potential security issue has taken place (intrusion detection system)
Corrective Control
Remediate security issues that have already controlled (restoring from backup)
Deterrent Control
Prevent an attacker from seeking to violate security policies
Physical Controls
Impact the physical world
Compensating Control
Fill a known gap in a security environment
Technical Controls
Use of technology to achieve security objectives
Operational Controls
Use Human-Driven processes to manage technology in a secure manner
Management Controls
Improve the security of the risk management process itself
Risk Control Assessment timespan
Single Point in Time
Control Assessment
Test control effectiveness
Measuring Control effectiveness
Compromised end-user accounts, Vulnerabilities in Public-Facing systems, critical findings in scans, data breaches requiring notification
