Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Security + 601 > Lesson 19 + 20 Summarizing Risk Management Concepts > Flashcards

Lesson 19 + 20 Summarizing Risk Management Concepts Flashcards

1
Q

Risk management

A

Risk management is a process for identifying, assessing, and mitigating vulnerabilities and threats to the essential functions that a business must perform to serve its customers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Likelihood of occurrence

A

Likelihood of occurrence is the probability of the threat being realized.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Impact

A

Impact is the severity of the risk if realized as a security incident.

Some factors are such as the value of the asset or the cost of disruption if the asset is compromised.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

External threat actors

A

External threat

Natural disasters, such as the COVID-19 pandemic, illustrate the need to have IT systems and workflows that are resilient to widespread dislocation.

The most critical type of impact is one that could lead to loss of life or critical injury.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Internal risks

A

Internal risks come from assets and workflows that are owned and managed by your organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Multiparty risk

A

Multiparty risk is where an undesirable event impacts multiple organizations.

Multiparty risk usually arises from supplier relationships. If a critical event disrupts a supplier or customer, then your own organization will suffer.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

IP Theft: Intellectual property (IP)

A

IP Theft:

Intellectual property (IP) is data of commercial value that is owned by the organization.

This can mean copyrighted material for retail (software, written work, video, and music) and product designs and patents. If IP data is exfiltrated it will lose much of its commercial value

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Quantitative risk assessment

A

Quantitative risk assessment aims to assign concrete values to each risk factor.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Single Loss Expectancy (SLE)

A

Single Loss Expectancy (SLE)

Amount that would be lost in a single occurrence of the risk factor.

Exposure Factor (EF) is the percentage of the asset value that would be lost.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Annualized Loss Expectancy (ALE)

A

Annualized Loss Expectancy (ALE)

Amount that would be lost over the course of a year.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Annualized Rate of Occurrence (ARO)

A

The probability that a risk will occur in a particular year

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Qualitative risk assessment

A

Qualitative risk assessment - identifying significant risk factors.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Inherent risk

A

Inherent risk is the level of risk before any type of mitigation has been attempted.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Risk posture

A

Risk posture shows which risk response options can be identified and prioritized

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Risk mitigation

A

Risk mitigation (or remediation) is the overall process of reducing exposure to or the effects of risk factors.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

risk deterrence (or reduction)

A

risk deterrence (or reduction):

If you deploy a countermeasure that reduces exposure to a threat or vulnerability.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Risk Avoidance and Risk Transference

A

Avoidance means that you stop doing the activity that is risk-bearing.

Transference (or sharing) means assigning risk to a third party, such as an insurance company or a contract with a supplier that defines liabilities.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Risk Acceptance and Risk Appetite

A

Risk acceptance (or tolerance) means that no countermeasures are put in place either because the level of risk does not justify the cost or because there will be unavoidable delay before the countermeasures are deployed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

residual risk

A

residual risk is the likelihood and impact after specific mitigation, transference, or acceptance measures have been applied

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Control risk

A

Control risk is a measure of how much less effective a security control has become over time.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

risk register

A

risk register is a document showing the results of risk assessments in a clear format

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Business impact analysis (BIA)

A

Business impact analysis (BIA) is the process of assessing what losses might occur for a range of threat scenarios.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

business continuity planning (BCP)

A

business continuity planning (BCP) identifies controls and processes that enable an organization to maintain critical workflows in the face of some adverse event.

24
Q

continuity of operations planning (COOP)

A

continuity of operations planning (COOP) refers to the same sorts of activities when undertaken by a government agency, rather than a business.

25
Q

mission essential function (MEF)

A

mission essential function (MEF) is one that cannot be put off.

This means that the organization must be able to perform the function as close to continually as possible, and if there is any service disruption, the mission essential functions must be restored first.

26
Q

Maximum tolerable downtime (MTD)

A

Maximum tolerable downtime (MTD)

longest period of time that a business function outage may occur for without causing irrecoverable business failure

27
Q

Recovery time objective (RTO)

A

Recovery time objective (RTO)

the period following a disaster that an individual IT system may remain offline.

28
Q

Work Recovery Time (WRT)

A

Work Recovery Time (WRT)

Following systems recovery, there may be additional work to reintegrate different systems, test overall functionality, and brief system users on any changes or different working practices so that the business function is again fully supported

29
Q

Recovery Point Objective (RPO)

A

Recovery Point Objective (RPO)

Amount of data loss that a system can sustain. That is, if a database is destroyed by a virus, an RPO of 24 hours means that the data can be recovered (from a backup copy) to a point not more than 24 hours before the database was infected.

30
Q

Identification of Critical Systems

A

Identification of Critical Systems

  • People (employees, visitors, and suppliers).
  • Tangible assets (buildings, furniture, equipment and machinery, ICT (information communication technology) equipment, electronic data files, and paper documents).
  • Intangible assets (ideas, commercial reputation, bran, etc)
  • Procedures (supply chains, critical procedures, SOP).
31
Q

business process analysis (BPA). The BPA should identify the following factors:

A

business process analysis (BPA). The BPA should identify the following factors:

  • Inputs—the sources of information for performing the function (including the impact if these are delayed or out of sequence).
  • Hardware—the particular server or data center that performs the processing.
  • Staff and other resources supporting the function.
  • Outputs—the data or resources produced by the function.
  • Process flow—a step-by-step description of how the function is performed.
32
Q

MTTF

A

MTTF should be used for non-repairable assets.

Hard drive may be described with an MTTF, (Life Span)

While a server (which could be repaired by replacing the hard drive) would be described with an MTBF.

33
Q

Mean time to repair (MTTR)

A

Mean time to repair (MTTR) is a measure of the time taken to correct a fault so that the system is restored to full operation.

34
Q

internal disaster

A

An internal disaster is one that is caused by malicious activity or by accident by an employee or contractor—anyone or anything whose presence within the company or organization has been authorized.

35
Q

external disaster

A

external disaster events are caused by threat actors who have no privileged access.

External disaster includes disasters that have an impact on the organization through wider environmental or social impacts, such as disruption of public services or impacts to the supply chain.

36
Q

person-made disaster

A

A person-made disaster event is one where human agency is the primary cause.

Typical examples other than devastating cybersecurity incidents include terrorism, war, vandalism, pollution, and arson.

There can also be accidental person-made disasters, such as cutting through power or telecoms cabling.

37
Q

Disaster recovery plans (DRPs)

A

Disaster recovery plans (DRPs)

specific procedures to follow to recover a system or site to a working state following a disaster-level event.

38
Q

99s

Availability to downtime

A
  1. 9999% - 30 seconds downtime
  2. 999% - 5 min downtime
  3. 99% - 50 min downtime
  4. 9% - 9 hours downtime
  5. 9% - 87 hours down time
39
Q

Scalability

A

Scalability is the capacity to increase resources to meet demand within similar cost ratios.

two types of scalability:

  • To scale out is to add more resources in parallel with existing resources.
  • To scale up is to increase the power of existing resources.
40
Q

Elasticity

A

Elasticity refers to the system’s ability to handle these changes on demand in real time.

A system with high elasticity will not experience loss of service or performance if demand suddenly increases rapidly.

41
Q

power distribution unit (PDU)

A

power distribution unit (PDU):

These come with circuitry to “clean” the power signal, provide protection against spikes, surges, and brownouts, and can integrate with uninterruptible power supplies (UPSs).

Managed PDUs support remote power monitoring functions

42
Q

uninterruptible power supply (UPS)

A

uninterruptible power supply (UPS) will provide a temporary power source in the event of a blackout

43
Q

RAID (Redundant Array of Independent Disks)

A 
RAID 0 – striping
RAID 1 – mirroring
RAID 5 – striping with parity
RAID 6 – striping with double parity
RAID 10 – combining mirroring and striping
44
Q

Disk Redundancy

Multipath

A

multipath is focused on the bus between the server and the storage devices or RAID array.

A storage system is accessed via some type of controller

45
Q

Geographical dispersal

A

Geographical dispersal refers to data replicating hot and warm sites that are physically distant from one another.

This means that data is protected against a natural disaster wiping out storage at one of the sites. This is also described as a geo-redundant solution

46
Q

Asynchronous and Synchronous Replication

A

Synchronous replication is designed to write data to all replicas simultaneously.

Asynchronous replication writes data to the primary storage first, then copies data to the replicas at scheduled intervals.

47
Q

On-Premises versus Cloud

A

This cost is one of the big drivers of cloud services, where local and geographic redundancy are built into the system, if you trust the CSP to operate the cloud effectively.

48
Q

Differential backup

A

Differential backup – from last FULL backup, includes all files changed since last full backup -> Only last full backup needed for restore.

Only needs two tapes sets for restoration, it is faster than incremental.

49
Q

Incremental backup

A

Incremental backup – from last backup, includes files changed during the day -> all previous backups needed to restore.

This type of backup can save backup time but be more time consuming when restoration is needed

50
Q

Nonpersistence

A

Nonpersistence means that any given instance is completely static in terms of processing function.

Mechanisms for ensuring nonpersistence:

  • Snapshot/revert to known state—this is a saved system state that can be reapplied to the instance.
  • Rollback to known configuration—a physical instance might not support snapshots but has an “internal” mechanism for restoring the baseline system configuration, such as Windows System Restore.
  • Live boot media—another option is to use an instance that boots from read-only storage to memory rather than being installed on a local read/write hard disk.
51
Q

change control process

A

change control process

Used to request and approve changes in a planned and controlled way.

52
Q

Change Management

A

Change Management

Implementation of changes should be carefully planned, with consideration for how the change will affect dependent components.

53
Q

Layered security

A

Layered security is typically seen as improving cybersecurity resiliency because it provides defense in depth.

The idea is that to fully compromise a system, the attacker must get past multiple security controls, providing control diversity.

54
Q

Active defense

A

Active defense means an engagement with the enemy, deploying decoy assets to act as bait/lure.

55
Q

honeypot/honeynet/honeyfile

A

honeypot is a computer system set up to attract threat actors,

honeynet is an entire decoy network.

honeyfile is fake data

Security + 601 (13 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions