Risk management Lecture 2 Flashcards
(37 cards)
What are your options in regards to responding to an identified risk?
- Remediate or mitigate the risk
- Avoid the risk by removing the business process / activity altogether
- Transfer the risk to another organization, e.g., purchasing an insurance
- Accept the risk
When choosing how to respond to an identified risk, what key considerations do you have to take before selecting an option?
A) Cost vs. benefits – you do not want to buy a lock (or door) which is more expensive than the
content within the room!
B) Only the business owners can accept a risk
C) Although you can mitigate a risk in many cases, it is very Rare that you can eliminate the risk
entirely
Is risk appetite a universal value across all businesses?
Risk can be defined differently across some organizations in regards to different categories of risk.
A) If a company has internal expertise to handle a risk then the tolerance to the risk can be higher
B) alignment with business objective. When business stake is high, risk appetite can be higher in some
cases. Stay in mind that business objective is the driver of almost everything, risk functions exist only
to support the business.
What is Risk Tolerance?
risk tolerance is the tolerable deviation from the level set by risk appetite
definition.
e.g., company standard says “all critical vulnerabilities must be addressed within 30 days”;
but under certain circumstances, addressing them within 45 days can be tolerated. Remember that
this type of deviation typically requires approval on a case-by-case basis, and it would require sign-off
from risk owners or senior management.
What is the difference between risk appetite and risk tolerance?
risk appetite is how much the business is willing to live with on a long term basis
while risk tolerence is a how much a business is willing to put up with past their risk appetite on a short term basis
What is Inherent risk?
the risk level or exposure without taking into account the actions that management has taken or might take
What is a control?
Controls are methods, may they be technical, administrative or physical an organization can use to mitigate risk.
or.
control is to bring down the residual risk to an acceptable level!
What are the kinds of controls a company can take to mitigate risk?
Technical
eg. anti-virus software
Administrative
eg. company policy forbiding use of non work sanctioned websites
Physical
eg. placing a lock on a door
What is control effectiveness?
A measure of how effective a control is at mitigating risk.
Possibly measured with:
Highly effective, somewhat effective, and not effective.
What is Residual Risk?
the remaining risk after management has implemented risk response. Keep in mind that the purpose of control is to bring down the residual risk to an acceptable level!!
When faced with a “High rated” inherent risk
with “highly effective” control method
What is the residual risk?
The residual risk would be Low
When faced with a “High rated” inherent risk
with “not effective” control method
What is the residual risk?
The residual risk would be high
What is BCP ( Business continuity Planning)?
BCP are plans businesses use to remain functional during undesirable situations such as:
flooding, earthquakes, aws outages, cyber attacks
What is the the key to BCP(Business Continuity planning)?
The key is prioritization.
What is DR(Disaster recovery)?
Disaster recovery is a key component of BCP(Business Continuity planning) and it is focused on recovering the IT systems
What is a BIA(Business impact analysis)?
BIA is a careful examination of business processes and support functions,
as well as the system of business processess in their entirety to better understand the objectives of recovery
How do you assess whether one business process(or application) is more important than another?
Conduct a BIA(Business impact analysis)
What is RTO(Recovery Time Objective)?
RTO is the earliest time period within a business process most be restored after a disaster to avoid unacceptable consequences.
What is RPO(Recovery Point Objective)?
RPO is the acceptable amount of data loss measured in time.
How much data can we afford to lose in disaster?
Helps determine frequency of data backups
For example, if the RPO is set to 30 minutes for application XYZ, then a backup of the application data
is required to be done every 30 minutes (or less). If no data loss is acceptable, then the RPO is zero. If
this is the case, you will have to replicate your data in real-time to the DR site.
What is MTD(Maximum tolerable downtime)?
MTD Represents the total amount of time a business process can be disturbed without causing unacceptable consequences.
Determingi the MTD of critical business processos is important because it helps define IT stability levels and urgency for recovery.
An example showing relationship between RTO and MTD:
Business Process A has a MTD = 5 hours
Business Process B has a MTD = 4 hours
A Windows server is supporting both Process A and B. In other words, both Process A and B have a
dependence on the server. What is the RTO for the Windows server?
Answer - 4 hours
What are the 3 different methods for data backup?
Full Backup
Incremental Backup
Differential Backup
What is a Full Data Backup?
– read the name and you get it right! It is a full copy of your entire data set. Make the recovery work easier, but very time consuming to
produce a full copy backup. Also, you will need large number of tapes or disks!
What is an incremental data backup?
– only backup the data that has changed since the previous full backup. For example, a full backup takes place every Sunday evening.
Monday evening you will do an incremental backup to cover Monday’s change of data. Tuesday evening you will do another incremental
one to cover Tuesday’s change. Keep doing it every day till the next full backup taking place. Now backup work is much easier, but
recovery would become difficult.
Suppose you need to restore the data backup for a Wednesday, then you need recover 4 pieces of backups in sequence
Sunday’s full backup, Monday’s incremental, Tuesday’s incremental, and Wednesday’s incremental. If say Tuesday’s
backup happens to be a bad disk, then your recovery will fail!
What is a differential backup?
similar to incremental backup. The difference is that while an incremental backup only includes the data that has changed since the
previous backup, a differential backup contains all of the data that has changed since the last full backup.
Back to the above example, you run a full backup on Sunday and a differential backup each day for the rest of the week. Now suppose you need to restore the data
backup for a Wednesday, then you will only need two pieces of back – Sunday’s full backup + Wednesday’s differential backup!
