Midterm Flashcards
(25 cards)
What is RPO?
Recovery Point Objective
What is RTO?
Recovery Time Objective
What is MTD?
Maximum Tolerable Downtime
What are the three types of Control?
- Technical Control
- Administrative Control
- Physical Control
What is a Risk Appetite?
The amount of risk a company is willing to accept depending depending on the objective
EXAMPLE
An organization might state that it has a “moderate” appetite for market expansion risks but a “low” appetite for compliance risks.
A tech company may have a high risk appetite for innovation and R&D investments but a low risk appetite for cybersecurity breaches.
What is a Risk Tolerance?
Example
Financial Risk: “We will not tolerate quarterly losses exceeding $500,000.”
Operational Risk: “We will accept a system downtime of up to 2 hours per month.”
Compliance Risk: “We have zero tolerance for regulatory non-compliance.”
What is CVSS?
Common vulnerability scoring system
- Low (0-3.9)
- Medium (4-6.9)
- High (7-8.9)
- Critical (9-10)
What is CER?
Crossover Data Rate
What is IT Risk?
Potential losses, Cybersecurity threats, data breaches, system failures etc.
What are the Measurability of IT Risk?
Quantitative Metrics, Qualitative Assessments, Risk Scores and Continuous monitoring
What is Quantitative Metrics?
Number of incidents, financial losses from breaches, downtime duration
What is Risk Scores?
Combing qualitative and quantitative data which results in risk scores
What is the FORMAL definition of risk?
Risk ($/year) = potential impact of an event on the business ($ amount of lost revenue) * estimates frequency of such events (# of events per year)
ALE (Annual Loss Expectancy) = SLE (Single Loss Expectancy) * ARO (Annualized Rate of Occurrence)
What is SLE?
Single Loss Expectancy - defined as a dollar amount that is assigned to a single event that represents the companies potential loss amount if a specific threat were to take place
What is ARO?
Annualized Rate of Occurrence - value that represents the estimates frequency of a specific threat taking place within a 12- month period. For example, ARO = 2, means event takes place twice a year; ARO = 0.5, means event takes place once for every two years; ARO = 0, means event wont happen at all
What is ERM (Enterprise Risk Management)?
- Process effected by an entitys board of directors, management and other personnel
- Risk appetite is defined by COSO as “the amount of risk, on a broad level that an organization is willing to accept in pursuit of its business objectives.
What are key benefits following common framework for managing enterprise risks?
- Adopt a common risk language
- Conduct an enterprise risk assessment to identify and prioritize the organizations critical risks
- Perform a gap analysis of the current and target capabilities around managing the critical risks
- Make informed business decisions at all levels of an organization using a repeatable process
- Align risk management effort with company’s vision, goals and objectives
What are the KEY elements of an ERM (Enterprise Risk Management) framework?
Business Strategy <-> Risk Culture - > Risk Governance, Risk Universe, Risk Management Policies, Risk Appetite -> Identify, Measure, Manage, Monitor, Report
What is a KRI?
Key Risk indicators - a metric used by organizations to provide an early signal of increasing risk exposures in various areas of the enterprise
Leading indicators VS lagging indicators
Leading indicators (PROACTIVE) - leading indicators identify emerging trends for risks and enable management to take proactive steps to prevent events from occuring
Lagging indicators (DETECTIVE) - Lagging indicators may be considered “detective” in nature and provide information about events that have occurred in the past
3 LOD ( Line of Defence) to manage IT risks?
1st Line of defence - business and IT functions
2nd Line of defence - Information and technology risk management functions
3rd Line of defence - Internal Audit
What are some key challenges for the 3 lines of defense model?
- May require change of exisiting business processes
- Lack of awareness or education for the first line staff
- Can be expensive to operate
What can be considered when tasked with designing an IT risk management framework form scratch
- Companys existing framework or processes for risk management
- level of maturity for risk managing and the companys overall awareness about risk management
- Competitive landscapeof the industry in which the company operates
