17 Risk Management & Privacy Flashcards
(13 cards)
What helps organizations prioritize cybersecurity efforts?
Risk identification and assessment
This process involves identifying all risks and conducting a business impact analysis.
What do cybersecurity analysts conduct to assess the potential degree of risk?
Business impact analysis
This analysis is based on the probability of occurrence and the magnitude of potential effects.
What is a source of external risk for organizations?
Vendors
Organizations should conduct supply chain assessments to mitigate risks from vendors.
What reduces the likelihood that a previously unidentified risk at a vendor will negatively impact the organization?
Vendor due diligence
This involves assessing the vendor’s systems as part of risk assessment practices.
What technique verifies that hardware was not tampered with after leaving the vendor’s premises?
Hardware source authenticity techniques
Hardware-based authentication techniques use physical devices to verify a user’s identity, adding an extra layer of security beyond passwords. These methods often involve cryptographic tokens or smart cards that generate one-time passwords or digital signatures to authenticate users. Examples include USB tokens, keyfobs, and smart cards.
These techniques are crucial for ensuring the integrity of hardware.
Name one risk management strategy that changes business practices to make a risk irrelevant.
Risk avoidance
This strategy modifies practices to eliminate the risk.
What are techniques that seek to reduce the probability or magnitude of a risk called?
Risk mitigation techniques
These techniques aim to lessen the impact or chance of risks occurring.
What approach moves some of the risk to a third party?
Risk transference
This strategy involves outsourcing certain risks to external entities.
What does risk acceptance acknowledge?
The presence of the risk
Organizations continue normal operations despite the risk being acknowledged.
What does disaster recovery planning aim to build?
Resiliency
This planning is activated during natural or human-made disasters.
What does a disaster recovery plan help an organization do?
Quickly recover its information and systems
The plan is essential for resuming normal operations after a disruption.
What should organizations develop to protect sensitive personal information?
Privacy programs
These programs protect personal information from misuse and unauthorized disclosure.
What types of information should privacy programs cover?
- Personally identifiable information (PII)
- Protected health information (PHI)
- Financial information
- Other records impacting personal privacy
These elements are crucial for maintaining individual privacy.
