ch 15 Flashcards
(82 cards)
A situation that involves exposure to some type of danger
Risk
To create a level of protection that mitigates the vulnerabilities to the threats and reduces the potential consequences
Managing risk
A formal process of examining the seriousness of a potential threat as well as the likelihood that it will be carried out
Threat assessment
what classification of threat is the action that affects the long term goal of the organization
strategic
what classification of threat is the following (or not following) a regulation or standard
compliance
what classification of threat is the action of impact of financial decisions or market factors
financial
what classification of threat is the following events that impact the daily business of the organisation
operational
what classification of threat is the events that affect information technology systems
technical
what classification of threat is the following actions related to the management of the organisation
managerial
a network that moves a product from the supplier to the customer
Should be viewed as assets to the enterprise and their threats should be cataloged
Supply chain
Involves an automated software vulnerability scan through a system
• Testing
Attempts to actually penetrate the system to perform a simulated attack
Intrusive vulnerability scan
Uses only available information to hypothesize the status of the vulnerability
Non-intrusive vulnerability scan
Designed to exploit any weaknesses in systems that are vulnerable
Penetration testing authorization should be obtained
Penetration test (pentest)
Methodology for making modifications and keeping track of changes
Ensures proper documentation of changes so future changes have less chance of creating a vulnerability
Change management
Two major types of changes that need proper documentation
Changes to system architecture
Changes to file or document classification
(C M T)
Change management team
Subject’s access level over an object, such as a file
Privilege
Body responsible for overseeing the changes
Change management team (C M T)
Process of assigning and revoking privileges to objects
Privilege management
Periodically reviewing a subject’s privileges over an object
Objective: determine if subject has the correct privileges
Privilege auditing
Components required to identify, analyze, and contain an incident
Incident response
Planning, coordination, communications, and planning functions needed to resolve incident
Incident handling
The “framework” and functions required to enable incident response and incident handling within an organization
Incident management
