Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

CyberSecurity > Lecture 10 > Flashcards

Lecture 10 Flashcards

(80 cards)

Start Studying
1
Q
A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is managing risk?

A

Managing risk is to create a level of protection that mitigates vulnerabilities to threats and reduces potential consequences

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What does managing risk involve?

A

Defining what it is understanding risk types knowing different methods of risk analysis realizing how to manage risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is an asset in risk management?

A

Any item that has a positive economic value

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is asset value?

A

The relative worth of an asset

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is a threat?

A

A type of action that has the potential to cause harm to an asset

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

How is risk defined?

A

A situation that involves exposure to some danger

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

How can risk also be described?

A

A function of threats consequences of those threats and the resulting vulnerabilities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are the five threat categories?

A

Strategic compliance financial operational technical managerial

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is an example of a strategic threat?

A

Theft of intellectual property not pursuing a new opportunity loss of a major account competitor entering the market

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is a compliance threat?

A

Following or not following a regulation or standard such as breach of contract or not responding to new laws

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is a financial threat?

A

Impact of financial decisions or market factors like increase in interest rates or global financial crisis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is an operational threat?

A

Events impacting daily business such as fire hazardous chemical spill or power blackout

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is a technical threat?

A

Events affecting IT systems such as denial of service attack SQL injection or virus

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is a managerial threat?

A

Actions related to management such as long-term illness of company president or key employee resigning

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

How can risk types be grouped?

A

Internal and external legacy systems multiparty intellectual property software compliance and licensing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is risk analysis?

A

A process to identify and assess factors that may jeopardise success of a project or goal

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Why is following a methodology important in risk analysis?

A

It helps minimise human bias and involves many individuals in identifying risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is Risk Control Self-Assessment RCSA?

A

A methodology where management and staff collectively identify and evaluate risks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What are the two approaches to risk assessment?

A

Qualitative risk assessment using educated guesses and quantitative risk assessment using hard numbers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

How does qualitative risk assessment work?

A

Assigns numeric value or label like high medium or low based on observation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is quantitative risk assessment?

A

Attempts to create hard numbers using historical data divided into likelihood and impact of risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Name some quantitative tools used to predict risk likelihood.

A

Mean time between failure MTBF mean time to recovery MTTR mean time to failure MTTF failure in time FIT

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is Annualized Rate of Occurrence ARO?

A

Historical data used to determine likelihood of risk occurring within a year

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
What sources provide data for risk analysis?
Law enforcement insurance companies computer incident monitoring organisations
26
What does risk impact involve?
Determining monetary loss associated with an asset if risk occurs
27
What is Single Loss Expectancy SLE?
Expected monetary loss every time a risk occurs
28
What is Annualized Loss Expectancy ALE?
Expected monetary loss for an asset due to risk over one year
29
What is a risk register?
A list of potential threats and associated risks
30
What is a risk matrix or heatmap?
A visual colour-coded tool listing impact and likelihood of risks
31
What does risk appetite involve?
Reducing risk to an acceptable level for the organisation
32
What are the four strategies for dealing with risks?
Acceptance transference avoidance mitigation
33
What is a security control?
A safeguard or countermeasure used to protect confidentiality integrity and availability of technology and data
34
What are the three categories of controls?
Managerial operational technical
35
Give an example of managerial control related to phishing.
Acceptable use policy specifying users should not visit malicious websites
36
Give an example of operational control related to phishing.
Conducting workshops to train users to identify and delete phishing messages
37
Give an example of technical control related to phishing.
Unified threat management device performing packet filtering anti-phishing and web filtering
38
Name six types of controls.
Deterrent preventative physical detective compensating corrective
39
What is a deterrent control?
Discourages attack before it happens like posting video surveillance signs
40
What is a preventative control?
Prevents attack before it happens like security awareness training
41
What is a physical control?
Prevents attack by physical means like building fences around perimeter
42
What is a detective control?
Identifies attack during attack like installing motion detection sensors
43
What is a compensating control?
An alternative during attack like isolating an infected computer on a different network
44
What is a corrective control?
Lessens damage after attack like cleaning a virus from infected server
45
What are some risks associated with using third parties?
Difficulty coordinating diverse activities network access risks onboarding offboarding privacy and data considerations
46
What are interoperability agreements?
Formal contracts related to security policy and procedures between parties
47
Name some types of interoperability agreements.
Service level agreement business partnership agreement memorandum of understanding nondisclosure agreement
48
What is a Service Level Agreement SLA?
A contract specifying services provided and responsibilities of each party
49
What is a Business Partnership Agreement BPA?
A contract establishing rules and responsibilities of each partner
50
What is a Memorandum of Understanding MOU?
An agreement between two or more parties
51
What is a Non-Disclosure Agreement NDA?
A legal contract restricting sharing of confidential material
52
What is End of Life EOL?
A term indicating a product has reached end of its useful life
53
What is End of Service EOS?
Indicates the end of support for a product
54
Why is user training important in risk management?
It results in risk awareness helping users understand risks impacts and how to manage them
55
What are some techniques used for user training?
Computer-based training role-based awareness training gamification capture the flag phishing simulations
56
How is privacy defined?
The state or condition of being free from public attention observation or interference to the degree a person chooses
57
What are common user concerns about private data?
Individual inconveniences identity theft association with groups statistical inferences
58
What is a common issue with data gathering?
Data is gathered and kept in secret without users knowing what is collected or how it is used
59
Why is data accuracy a concern?
Users cannot verify or correct their data which may lead to erroneous decisions
60
How can identity theft affect data accuracy?
Victims have inaccurate info added by thieves and cannot correct it
61
What are unknown factors in data ratings?
Many combined data points create ratings but how they affect overall rating is unknown
62
What is informed consent in data privacy?
User permission to collect and use data which is often missing or misunderstood
63
What important decisions use private data?
Jobs consumer credit insurance identity verification
64
What consequences can a data breach cause to an organisation?
Reputation damage intellectual property theft fines
65
Name some data types requiring protection.
Confidential private sensitive critical proprietary public personally identifiable information protected health information
66
What is data minimisation?
Limiting collection of personal information to what is directly relevant and necessary
67
What is data masking also called?
Data anonymisation it obfuscates sensitive elements of data
68
What is tokenisation?
Replacing sensitive data elements with random strings called tokens
69
What is data sovereignty?
Country-specific legal requirements applied to data
70
What is the information life cycle?
The flow of data from creation to becoming obsolete
71
How should paper media data be destroyed?
Burning shredding pulping pulverising
72
Why should electronic data not be deleted with OS delete command?
Because data can still be retrieved with third-party tools
73
What methods securely remove electronic data?
Data sanitation wiping with zeros or random data and degaussing magnetic drives
74
What is wiping in data destruction?
Overwriting disk space with zeros or random data
75
What is degaussing?
Permanently destroying magnetic drive by eliminating its magnetic field
76
What is the importance of regularly performing risk analysis?
To identify and assess factors that may jeopardise success of projects or goals
77
What are the two approaches to risk calculation?
Qualitative risk calculation and quantitative risk calculation
78
What is often overlooked in risk management?
The importance of providing training to users
79
What must an organisation do once a data breach occurs?
Take specific actionable steps to address the breach
80
Why should data no longer useful be destroyed?
To protect privacy and prevent unauthorized access

CyberSecurity (16 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions