Risk Flashcards
The lack of the countermeasure or a weakness that is in place
vulnerability
Any potential danger that is associated with the exploitation of the vulnerability
a threat
The likelihood of a threat agent exploiting a vulnerability in the corresponding business impact
Risk
An instance of being exposed to loss
Exposure
Also known as the countermeasure it is put into place to mitigate or reduce the potential risk
a control
Controls are put into place reduce the risk of an organization faces and they come in three main flavors:
Administrative, technical and physical controls.
We know that the different categories of controls to be used are administrative technical and physical.
But what do these controls actually do? The different functionalities of security controls are (6):
Deterrent preventative corrective recovery detected compensating
What is a group of standards called that serves as industry best practices for the management of security controls in a holistic manner within organizations around the world
ISO/IEC 27000 series
Name 4 examples of enterprise architecture development a.k.a. frameworks
Zachman framework, TOGAF, DoDAF, MODAF
Name two standards under the security controls development
CobiT (objectives fir IT Mgmt dev by ISACA & ITGI)
SP 800-53 -NISt
Name two models for process management
Six Sigma, CMMI
Risk = T * V
risk = threat x vulnerability
SLE = AV * EF
single loss expectancy = asset value * exposure factor
ALE = SLE * ARO
Ale $ = SLE $ x ARO %
ARO= #/ yr.
annualized rate of occurrence.
Delphi Technique
anonymous survey to gain uninfluenced responses for consensus. (qualitative analysis)
CobiT framework.Goal: define controls that should be used to properly manage IT & ensure it maps to business needs. Name the 4 domains:
4 Domains:Plan and OrganizeAcquire and ImplementDeliver and Support Monitor and EvaluateIt’s a chklist approach to guide companies when they buy, install, test, certify and accredit IT products
which NISt publication outlines controls agencies. need to put into place to be FISMA complaint ?
NIST 800-53
Name 3 categories if control outlined by NIST:
M-O-T
COSO is model for corporate governance while CobiT is a model for IT governance. What are the 5 components of COSO:
Control EnviroRisk AssessmentControl ActivitiesInfo & CommMonitoring
what’s the difference between a risk assessment and a vulnerability assessment
Vulnerability assessment find the holes. A risk assessment calculates the probability of the vulnerabilities being exploited and the associated business impact
What is Delphi technique
Adelphi technique is a group decision method to ensure that each member gets an honest opinion of what here she thinks result of a particular threat will be
Residual risk is the risk leftover to deal with after countermeasures have been sent. What is the formula for residual risk?
{Threats x vulnerability x asset value = total risk} x control gap = residual risk
Total risk is risk a company faces if it is not going to implement any type of safeguard!! what is the formula for total risk
Threats x vulnerability x asset value = total risk
