Risk Assessments Flashcards
Risk Assessments
A process used inside of risk management to identify how much risk exists in a given network or system
Risk
The probability that a threat will be realized
Vulnerabilities
Weaknesses in the design or implementation of a system
Threat
§ Any condition that could cause harm, loss, damage, or compromise to our information technology systems
§ Threats are external and beyond your control
Risk Avoidance
A strategy that requires stopping the activity that has risk or
choosing a less risky alternative
Risk Transfer
A strategy that passes the risk to a third party
Risk Mitigation
A strategy that seeks to minimize the risk to an acceptable level
Risk Acceptance
A strategy that seeks to accept the current level of risk and the costs associated with it if the risk were realized
Residual Risk
The risk remaining after trying to avoid, transfer, or mitigate the risk
Qualitative Risk Analysis
o Qualitative analysis uses intuition, experience, and other methods to assign a relative value to risk
o Experience is critical in qualitative analysis
Quantitative Risk
o Quantitative analysis uses numerical and monetary values to calculate risk
o Quantitative analysis can calculate a direct cost for each risk
Single Loss Expectancy (SLE)
Cost associated with the realization of each individualized threat that occurs
Asset Value x Exposure Factor
Annualized Rate of Occurrence (ARO)
Number of times per year that a threat is realized
Annualized Loss Expectancy (ALE)
Expected cost of a realized threat over a given year
ALE = SLE x ARO
Security Assessments
§ Verify that the organization’s security posture is designed and configured properly to help thwart different types of attacks
§ Assessments might be required by contracts, regulations, or laws
§ Assessments may be active or passive
