Managing Risk Flashcards
1
Q
Risk Calculations
A
Weigh the potential threat against the likelihood of it occurring
2
Q
Residual Risk
A
Risk that will and must remain
3
Q
Annual Loss Expectancy (ALE)
A
A calculation used to identify risks and calculate the expected loss each year
4
Q
ALE
A
Annual Loss Expectancy
5
Q
Annualized Rate of Occurrence (ARO)
A
A calculation of how often a threat will occur
6
Q
ARO
A
Annualized Rate of Occurrence
7
Q
Asset Value (AV)
A
The assessed value of an item
8
Q
AV
A
Asset Value
9
Q
Exposure Factor (EF)
A
The potential percentage of loss to an asset if a threat is realized
10
Q
MTD
A
Maximum Tolerable Downtime
11
Q
MTBF
A
mean time between failure
12
Q
MTTF
A
mean time to failure
13
Q
MTTR
A
mean time to restore
14
Q
Recovery point objective (RPO)
A
The point last known good data prior to an outage that is used to recover systems
15
Q
RPO
A
Recovery point objective
16
Q
Recovery time objective (RTO)
A
The max amount of time that a process or service is allowed to be down and the consequences still be considered acceptable
17
Q
RTO
A
recovery time objective
18
Q
Redundant Array of Independent Disks (RAID)
A
A configuration of multiple hard disks used to provide fault tolerance should a disk fail
19
Q
RAID
A
Redundant Array of Independent Disks
20
Q
single loss expectancy (SLE)
A
The cost of a single loss when it occurs
21
Q
SLE
A
single loss expectancy
22
Q
SLA
A
service level agreement
23
Q
SPOF
A
single point of failure
24
Q
Risk calculation formula
A
SLE x ARO = ALE
25
threat
anything that can harm your resources
26
Types of threats
Environmental
Manmade
Internal vs External
27
vulnerability
a weakness that could be exploited by a threat
28
Chief components of a risk assessment process
- Risks to which the organization is exposed
- Risks that need addressing
- Coordination with the business impact analysis (BIA)
29
BIA
business impact analysis
30
Threat Vector
the way in which an attacker poses a threat (particular tool or means of exploiting)
31
A privacy impact assessment (PIA) requires what three things?
- To ensure conformance with applicable legal, regulatory, and policy requirements for privacy
- Determine risks and effects
- Evaluate protections and alternative processes to mitigate potential privacy risks
32
The four possible responses to identifying and assessing the risks that exist
Risk Avoidance
Risk Transference
Risk Mitigation
Risk Acceptance
33
Audits used in risk mitigation
- user rights
- permission reviews
- change management
- incident management
34
cloud computing
hosting services and data on the Internet instead of hosting it locally
35
Three ways of implementing cloud computing
- Platform as a Service
- Software as a Service
- Infrastructure as a Service
36
Platform as a Service (PaaS)
Vendors allow apps to be created and run on their infrastructure.
Known as 'cloud platform service'
37
PaaS
Platform as a Service
38
Software as a Service (SaaS)
Applications are remotely run over the web
Costs are usually computed on a subscription basis
39
SaaS
Software as a Service
40
Infrastructure as a Service (IaaS)
Clients pay a cloud service provider for the resources used
Resembles the traditional utility model
41
Risks associated with virtualization
- Breaking out of the virtual machine
- Intermingling network and security controls
- Hypervisor exploits
42
Hypervisor
the virtual machine monitor; the software that allows virtual machines to exist
43
SOP
Standard Operating Procedure
44
Mandatory Vacation Policy
*Personnel policy*
Requires employees to take time away from work to refresh. It also allows the company to ensure it can fill skill gaps and can help to detect fraud
45
Job Rotation Policy
*Personnel policy*
Defines intervals at which employees must rotate through positions. It prevents a company from being too dependent on a single person for a job.
46
Separation of Duties Policies
*Personnel policy*
Requires more than one person to complete key processes. Requires employees committing fraud to collude with others, thus reducing the possibility of it happening. This policy also reduces overall errors of processes.
47
collusion
an agreement between two or more parties established for the purpose of committing deception or fraud
48
Clean Desk Policy
*Personnel Policy*
| Limits employees to only having current work on their desk. This increases overall security.
49
Background Check Policy
*Personnel Policy*
| Since all employees will handle data that is sensitive, they must have reason to be trusted
50
Nondisclosure Agreements Policy
*Personnel Policy*
| NDA policy is used to allow employees to work with sensitive public or proprietary data
51
Onboarding Policies
*Personnel Policy*
| The onboarding policies used allow for well-trained employees who feel they are of value to the company
52
Continuing Education Policies
*Personnel Policy*
Continuing education policies are important as they allow employees to rise in value and is required to allow for the maintenance of necessary certifications
53
Exit Interview Policies
*Personnel Policy*
| Allow the company to learn and gain honest feedback
54
Role-Based Awareness Training Policy
*Personnel Policy*
| Training employees to the level of their privilege adheres to the 'least privilege principle'
55
Acceptable Use Policies (AUP)
*Personnel Policy*
| Describe how the employees in an organization can use company systems and resources
56
pod slurping
When portable devices are plugged directly into a machine, they bypass the network security measures (such as a firewall) and allow data to be copied
57
Adverse Actions Policy
*Personnel Policy*
Details what must be done in the event of termination, administrative leave, or any other reprimanding of employees. Includes suspending accounts, revoking privileges, etc
58
General Security Policies
*Personnel Policy*
| Define what controls are required to implement and maintain the security of systems, users, and networks
59
False Positive
Type I error;
| Alert to an event which is not an incident
60
False Negative
Type II error;
| Lack of an alert for an event which is an incident or any other event which should require an alert
61
Type I error
False Positive
62
Type II error
False Negative
63
Type III error
An error in which you came to the correct conclusion but for all the wrong reasons
64
Leading ways to address business continuity
Do a BIA and implement 'best practices'
65
Business impact analysis (BIA)
*Business Continuity Best Practice*
The process of evaluating all of the critical systems in an organization to define impact and recovery plans. Focuses on the impact a loss would have on the company.
NOT concerned with external threats or vulnerabilities
66
Key components of a BIA
- Identifying critical functions
- Prioritizing critical business functions
- Calculating a timeframe for critical systems loss
- Estimating the tangible and intangible impact on the organization
67
Variables that affect 'impact'
- Life
- Property
- Saftey
- Finance
- Reputation
68
Identifying Critical Systems and Components
*Business Continuity Best Practice*
| Involves identifying points of failure and maintaining contingency plans
69
Automation/Scripting
*Business Continuity Best Practice*
| Automate courses of action for a range of scenarios that do not require human detection and reaction
70
Frameworks and Templates
*Business Continuity Best Practice*
| Includes scales for evaluating threats and deciding the best responses to them
71
Master Image
*Business Continuity Best Practice*
| Allows the administrator to more easily restore a system if a failure occurs
72
Nonpersistence
* Business Continuity Best Practice*
- Allows for a 'snapshot' of an operating system in an exploited stat to inspect it
- Allows for rolling back to a known configuration
- Allows for booting a system with 'live boot media'
73
Elasticity
*Business Continuity Best Practice*
| Ability to scale up (and scale down) resources as needed. Includes ability to pool resources
74
Scalability
*Business Continuity Best Practice*
| Allows for elasticity and only utilizing the resources required
75
Distributive Allocation
*Business Continuity Best Practice*
| Distributing the load (file requests, data routing, etc) so that no device is overly burdened
76
High Availability (HA)
*Business Continuity Best Practice*
Refers to measures such as redundancy, failover, and mirroring, used to keep services and systems operational during an outage.
77
Planning for Resiliency
*Business Continuity Best Practice*
| Capacity to recover quickly from difficulties
78
Redundancy
*Business Continuity Best Practice*
| Refers to systems that either are duplicated or 'fail over' to other systems in the event of a malfunction
79
Clustering
involves multiples systems connected together in such a way that if any of the systems fail, the others take up the slack
80
The major cost of failover systems
They can become prohibitively expensive
81
Fault Tolerance
*Business Continuity Best Practice*
| The ability of a system to sustain operation even though a critical component has failed
82
Two key components of fault tolerance
- Spare parts
| - Electrical power
83
UPS
uninterruptible power supply
84
Redundant Array of Independent Disks (RAID)
A technology that uses multiples disks to provide fault tolerance
85
RAID
Redundant Array of Independent Disks
86
RAID Level 0
disk striping; does not include any fault tolerance
87
RAID Level 1
disk mirroring; can be implemented as mirroring or duplexing
88
RAID Level 3
disk striping with a parity disk
89
RAID Level 5
disk striping with parity
90
The focus of 'change management'
How to document and control for a change
91
PIA
privacy impact assessment
