Risk Assessments Flashcards
(36 cards)
Risk Assessments
A process used inside of risk management to identify how much risk exists in a given network or system
Risk
The probability that a threat will be realized
Vulnerabilities
Weaknesses in the design or implementation of a system
Threat
§ Any condition that could cause harm, loss, damage, or compromise to our information technology systems
§ Threats are external and beyond your control
Risk Avoidance
A strategy that requires stopping the activity that has risk or
choosing a less risky alternative
Risk Transfer
A strategy that passes the risk to a third party
Risk Mitigation
A strategy that seeks to minimize the risk to an acceptable level
Risk Acceptance
A strategy that seeks to accept the current level of risk and the costs associated with it if the risk were realized
Residual Risk
The risk remaining after trying to avoid, transfer, or mitigate the risk
Qualitative Risk Analysis
o Qualitative analysis uses intuition, experience, and other methods to assign a relative value to risk
o Experience is critical in qualitative analysis
Quantitative Risk
o Quantitative analysis uses numerical and monetary values to calculate risk
o Quantitative analysis can calculate a direct cost for each risk
Single Loss Expectancy (SLE)
Cost associated with the realization of each individualized threat that occurs
Asset Value x Exposure Factor
Annualized Rate of Occurrence (ARO)
Number of times per year that a threat is realized
Annualized Loss Expectancy (ALE)
Expected cost of a realized threat over a given year
ALE = SLE x ARO
Security Assessments
§ Verify that the organization’s security posture is designed and configured properly to help thwart different types of attacks
§ Assessments might be required by contracts, regulations, or laws
§ Assessments may be active or passive
Active Security Assessments
Utilize more intrusive techniques like scanning, hands-on testing, and probing of the network to determine vulnerabilities
Passive Assessments
o Utilize open source information, the passive collection and analysis of the network data, and other unobtrusive methods without making direct contact with the targeted systems
o Passive techniques are limited in the amount of detail they find
Security controls are categorized as
Physical Controls
Technical Controls
Administrative Controls
Physical Controls
Any security measures that are designed to deter or prevent unauthorized access to sensitive information or the systems that contain it
Technical Controls
Safeguards and countermeasures used to avoid, detect, counteract, or minimize security risks to our systems and information
Administrative Controls
Focused on changing the behavior of people instead of removing the actual risk involved
NIST Security Controls Categories
Management Controls
Operational Controls
Technical Controls
Management Controls (NIST)
Security controls that are focused on decision-making and the management of risk
Operational Controls (NIST)
Focused on the things done by people
