Chapters 4-6 Flashcards
(43 cards)
What is Risk Management?
Identification, assessment and priotization of risks
What are the Two Formal Processes of Risk Management?
- Risk Identification and Assessment
- Risk Control
Who are the Communities of Interest in Risk Management?
- Information Security: leadership role in addressing risk
- Information Technology: building and maintaining secure systems
- Management: resource allocation and security prioritization
- Users: crucial in early detection and proper response to threats
What are the Steps of Risk Management?
- Evaluating Risk Controls
- Determining Cost Effective Control Options
- Acquiring and Installing Appropriate Controls
- Overseeing Processes for Effectivity
- Identfying Risks
- Assessing Risks
- Summarizing Findings
What are the Steps of Risk Identification?
- Plan and Organize Process
- Create System Component Categories
- Develop Inventory of assets
- Identify Threats
- Specify Vulnerable Assets
- Assign Value or Impact Rating to Assets
- Assess Vulnerability Likelihood
- Calculate Asset Relative Risk Factor
- Preliminary Review of Possible Controls
- Document Findings
How do you Inventory Information Assets?
- Identify Information Assets
- Determine Which Attributes of Each Information Asset Should be Tracked
What is Asset Ranking?
- Determine the Value of Assets
- Prioritizing According to Value
What is an Asset Classification Scheme?
- Categorizes information assets based on sensitivity
- Each category designates level of protection
- Must be comprehensive and mutually exclusive
What are Relative Values?
Comparative judgements made to ensure the most valuable information assets are given the highest priority
What is Threat Identification?
Assesses IT vulnerabilities and their capacity to compromise a system
What is Vulnerability Assessment?
The process of defining, Identifying, classifying, and prioritizing vulnerabilities
What is Risk Assessment?
Create a method to evaluate the relative risk of each listed vulnerability
What is the Extended Risk Formula?
Risk = Probability of Attack * Probability of Successful Attack * Value Lost on Successful Attack
What are the Goals of the Risk Management Process?
- Identify Information Assets and their Vulnerabilities
- Rank them According to Sensitivity
What is the Goal of the Risk Identification Process?
- Designate the Function of the Report
- Define who is Responsible for Preparing and Reviewing the Report
What is Risk Control?
Identifying Possible Controls
What are the Three General Categories of Control?
- Policies
- Programs
- Technical Controls
What are the Four Basic Strategies of Control Risks?
- Avoidance: applying safeguards against risks
- Transference: shifting risk to other areas or outside entities
- Mitigation: reducing impact of vulnerabilities
- Acceptance: accepting risk without control or mitigation
What are the Types of Mitigation Plans?
- Disaster Recovery Plan (DRP)
- Incident Response Plan (IRP)
- Business Continuity Plan (BCP)
What is a Metric?
- A measurement of a periodic or ongoing activity
- Used by management to measure key processes for their effectivities
What are the 3 Metrics categorizations?
- Key Risk Indicators (KRI): metrics associated with risk measurement
- Key Goal Indicators (KGI): metrics that portray attainment of strategic goals
- Key Performance Indicators (KPI): metrics that show the efficiency or effectivenes of security-related activities
What is Security Control?
Measures that reduce risk by eliminating or preventing harm or discovering and reporting it
What are the Types of Control Classifications?
- Management Controls
- Operational Controls
- Technical Controls
What are Management Controls?
Focuses on the selection of operational and technical controls to reduce risk of loss
