Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CRISC > Risk response and mitigation > Flashcards

Risk response and mitigation Flashcards

1
Q

what does the risk response phase of risk management focus on?

A

focuses on decisions made regarding the correct way to respond to risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

what is the purpose of the assessment report and risk register document?

A

they document the risk identified during the identification and assessment phases of the risk management process.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

what are the 4 types of risk response?

A
  • risk acceptance
  • risk mitigation
  • risk sharing (transfer)
  • risk avoidance
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Describe risk acceptance

A

the choice to accept risk is a conscious decision made by senior management to recognize the existence of risk and knowingly decide to allow (assume) the risk to remain without (further) mitigation. the decision to accept a risk is made according to the risk appetite and risk tolerance set by senior management.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

True or false. risk that falls within the organizational risk appetite should be accepted?

self insurance is a type of risk acceptance?

A

True for both

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

when will the organization choose to accept risk?

A
  • when no controls are available
  • the cost of the controls would outweigh their benefits.
  • when a risk is assessed to be extremely rare
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

describe risk mitigation

A

refers to the actions that the organization takes in order to reduce a risk. Mitigation is typically achieved through security controls, which affect the frequency and/or impact of the risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

describe risk transfer

A

decision to reduce loss by having another organization incur the cost.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

give examples of risk transfer

A

insurance and partnerships

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

describe risk avoidance

A

exiting the activities or conditions that give rise to risk. it is the choice that remains when no other response is adequate.

  • the exposure of risk is unacceptable by management
  • the risk cannot be transferred
  • mitigation that would bring the risk in line with acceptable levels is either impossible or would cost more than the benefits that the organization derives from the activities.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

what is the role of the risk practitioner in supporting risk based decisions?

A

to provide management with timely, accurate risk evaluations and solid supporting data so that informed decisions can be made.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

what are factors to consider when selecting a risk response?

A
  • the priority of the risk as indicated in the risk assessment report
  • the recommended controls from the risk assessment report
  • any other response alternatives that are suggested through further analysis
  • cost of the response options ( acquisition cost, training cost, impact of productivity, maintenance and licensing costs)
  • requirements for compliance with regulations or legislations
  • alignment of the response option with the strategy of the legislation
  • possibility of integrating the response with other organizational initiatives
  • compatibility with other controls in place
  • time, resources and budget available.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

true or false

risks response are typically recommended in business cases?

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

what are the two most common forms of analysis used to prepare a business case? for risk response

A
  • cost- benefit analysis

- return on investment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

what are factors that must be included in calculating the total cost of a control?

A
  • cost of acquisition (training, control, evaluations, rearchitect systems)
  • ongoing maintenance ( license, monitor and report, impact on productivity/performance, support and technical assistance)
  • cost to remove/replace control
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

describe ROI/ROSI

A

in determining ROI, the organization is trying to forecast the likelihood and impact of an incident and decides the adequate level of protection. the amount of security an organization decides to implement is dependent on its appetite for risk and the perception of exposure.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

True or false
organizations should co-ordinate with stakeholders on a proactive basis and perform rigorous user acceptance testing under conditions as close to real world use as possible prior to full implementation

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

what is a business process review?

A

examines the effectiveness and efficiency of an organization in meeting its goals and objectives.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

what is the purpose of a business process review?

A
  • identify problems or issues with the current process
  • gather information toward improving processes
  • prepare a road map to implement required changes
  • assign responsibility and accountability for projects
  • schedule individual projects according to priority
  • monitor project progress for attainment of milestones and production deliverables
  • review and obtain feedback on project results.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

list the steps of a business process review

A
  1. document and evaluate current business processes
  2. identify potential changes
  3. schedule and implement changes
  4. feedback and evaluation
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

what is the risk practitioners role with respect to control design and implementation?

A

provides advice on the selection, design, implementation, testing and operation of the controls.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

what are examples of compensating controls?

A

layered defense, increased supervision, procedural controls, increased audits and logging of system activity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

List the types of controls

A
  • compensating: reduces likelihood of threat event
  • corrective: decreases impact
  • detective: triggers preventative controls, discovers threat event
  • deterrent: reduces likelihood of a threat event
  • preventative: reduces impact, protects vulnerability
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

describe the categorization of controls

A
  • managerial (administrative): related to oversight, reporting, procedures and operations of a process. e.g policy, procedures, balancing, employee development and compliance reporting.
  • technical: aka logical controls and are provided through the use of a technology, piece of equipment and device. e.g. firewalls, antivirus software.
  • physical: are locks, fences, cctv and devices that are installed to physically restrict access to a facility or hardware.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

how can you support the ability to monitor controls and report on risk?

A

ensure that processes, logs and audit hooks are placed into the control framework. this ensures regular testing and reporting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

list and describe the types of risk

A
  1. inherent risk: risk level or exposure without taking into account the actions that management has taken or might take.
  2. residual risk: risk remaining after management has implemented a risk response, which is typically a mitigation activity, but may also include risk transfer.
  3. current risk: risk that exists in the moment. taking into account actions that have already been taken but not actions that are anticipated or have been proposed.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

describe a consideration in control implementation

A

consider the impact of controls on the ability of the business to meet its objectives and of the users to accomplish their tasks in a simple, logical manner

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

what are the risks associated with project and program management?

A
  • first a project may not meet its objectives, and second the failure of one or more projects may affect the performance of a program.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

what is the primary objective of a BIA?

A

identify the impact of an incident in order to understand and prioritize steps that can be taken for effective prevention or response.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

what is the purpose of testing?

A

provides an opportunity to uncover flaws early enough not only to prevent failure, but to do so in a cost effective manner. comprehensive testing includes testing at the unit/component, integration/system, and end-user levels.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

List the types of testing

A

progressive testing- begins with expectations and look for flaws.
regressive testing- works backwards from known problems to identify issues.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

what are good practices for testing?

A
  • considerations for data, version control and code
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

lists some considerations for data as a good testing practice?

A
  • validity of data
  • masking of data
  • test data should be complete and allow the testing of all possible process functions and error handling
  • using distinct test data and not production data
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

what is fuzzing ?

A

testing the limit of the acceptable range of values and values beyond the allowable range in order to verify the functionality of input validation and process integrity controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

why is environmental separation important?

A
  • development and production areas should be separated to prevent the potential for intentional and unintentional cross-population of data or application code outside of the approval process.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

what is version control?

A
  • assignment of specific version numbers of each revision of a system, making it possible for risk practitioners and engineers to distinguish between versions.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

why is a third party code review valuable?

A
  • can detect both unauthorized changes made by the programmer and implementations of error handling, input validation, or documentation that may be inadequate.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

what is white box testing

A
  • unit testing performed with the knowledge of the code

- from a vulnerability perspective

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

what is black box testing

A

testing in which the behavior of the system must be mapped out without the knowledge of how the code is written.
- from a penetration testing perspective

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

true or false

integration testing and unit testing is often performed in a separate area from the final system testing?

A

true

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

list and describe different test options

A
  1. recovery: checks the system’s ability to recover after a software or hardware failure
  2. security: verifies that the modified/new system includes provisions for appropriate access controls and does not introduce any security holes that may compromise other systems.
  3. stress: determines the maximum number of concurrent users/services the application can process by increasing the number of users/services on an incremental basis.
  4. volume: determines the maximum volume of records (data) that the application can process by increasing the volume on an incremental basis
  5. stress/volume: hybrid approach that uses large quantities of data to evaluate performance during peak hours
  6. performance: compares the performance of the subject system to similar systems using well-defined benchmarks
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

what is the purpose of a user acceptance testing

A
  • may highlight problems with functionality, training or process flow not detected earlier in the process.
  • purpose is to verify that the system meets user requirements and expectations, not whether it meets the stated design.
  • a failure suggest flaws in the organizations process for needs analysis and requirements definition
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

what is Quality assurance

A

planned and systematic plan of all action necessary to provide adequate confidence that an item or product conforms to established technical requirements.

purpose is to determine if a project delivered what it promised in the stated design, not whether that design actually meets user requirements and expectation.

a failure suggests flaws in the organization’s processes for development and execution.

44
Q

List and describe the three common changeover methods?

A
  1. parallel: operating new systems and old system at the same time.
  2. phased: replacing individual components or modules of the old system with new or modified components.
  3. abrupt: single instant movement from the old system to the new system, with the old system immediately taken offline
45
Q

what are some risks associated with abrupt changeover

A
  • asset safeguarding
  • data integrity
  • system effectiveness
  • system efficiency
  • change management challenges
  • duplicate or missing records
46
Q

complete the following

data migration or conversation of data poses a risk to…..

A
  • availability and data integrity
47
Q

list some considerations for data migration

A
  1. completeness of data:
  2. data integrity
  3. storage and security of data under conversion: data is backed up before conversion
  4. data consistency: field/record called for is consistent in old and new applications
  5. business continuity: application supports newer records as appended or added
48
Q

what is a fallback or rollback plan?

A

plan so that it is possible to return to the prior system or configuration.

49
Q

what is a post implementation review?

A

intended to document lessons, including whether the project was properly designed, developed, implemented and managed and whether appropriate controls were built into the systems

50
Q

what should a post implementation review consider?

A
  1. adequacy of the system
  2. projected cost versus benefits or ROI measurements
  3. recommendations that address any system inadequacies and deficiencies
  4. plan for implementing any recommendations
  5. assessment of the development project process
51
Q

list the steps in a project close out?

A
  1. assign responsibility for any outstanding issues to specific individuals and related budget for addressing issues.
  2. assign custody of contracts
  3. conduct postimplementation review with relevant stakeholders and include content related and process related criteria.
  4. document any risk that was identified in the course of the project and update risk register.
  5. complete a second postimplementation review to realize the true business benefits and costs, and use this as a basis to measure the projects overall success and impact on the business.
52
Q

list the control management procedures

A
  • proper installation
  • creation of policies and procedures to support operations
  • implementation of change management procedures to ensure correct configurations
  • training of staff to monitor, manage and review controls
  • assignment of responsibility for monitoring and investigation
  • creation of a schedule for review and reporting
53
Q

in which phase of the SDLC should the process to amend the deliverables be defined to prevent the risk of scope creep

A

feasibility or planning and initiation

54
Q

what should the risk treatment strategy be if the residual risk exposure level is deemed unacceptable by management

A

risk avoidance

55
Q

the best method for detecting and monitoring a hackers activities without exposing information assets to unnecessary risk is to use

A

honey pots: tool used for diverting a hacker away from critical files and alerts security of the hacker’s presence

56
Q

describe firewalls, bastion hosts, screened subnets

A

firewall: aim to keep the hacker out and is a preventative control
bastion hosts: attempts to keep the hacker out and is also a preventative control
screened subnets: or DMX provide a middle ground between the trusted internal network and the external, untrusted internet

57
Q

what is the most important task in system control verification?

A

managing the response time to critical alerts and alarms

58
Q

what is the control management lifecycle

A

business case, feasibility and cost benefit analysis, design, implementation and retirement

59
Q

what is normalization

A

performed to reduce redundant data

60
Q

what is a primary role of the system owner during the accreditation process

A

they select and document the security controls for the system

61
Q

what is user provisioning?

A

process of granting access to an application or system.

62
Q

what are entitlement reviews

A

performed to review the access of an individual to ensure that they have the proper access for their current role

63
Q

what is the purpose of system certification

A

security controls and processes are assessed for effectiveness

64
Q

which of the following best addresses the risk of data leakage?

A

AUP

65
Q

what is the primary goal of certifying a system prior to implementation?

A

to ensure that the system meets its specified security requirements at the time of testing

66
Q

what is a goal of risk response?

A

to ensure that tech used in the organization is adequately protected, secure and reliable.

67
Q

who has responsibility for a system?

A

system owner who is usually a senior manager in the department for which the system was built

68
Q

what are two common methods of providing enterprise consistency?

and what are other important parts of an overall information security strategy?

A

change control and system authorization.

asset inventory and configuration management.

69
Q

what is change control?

A

formal review and approval of all requests to change systems or configurations by a dedicated committee.

70
Q

what is the purpose of the change control board

A

when change request is submitted for review, they verify that

  • request does not unknowingly affect risk or security
  • change is formally requested, approved and documented.
  • change is scheduled at a time convenient for business and IT
  • all stakeholders affected by the change are advised of the change

the intention of a CCB model is to provide a balance between allowing needed changes to occur and preserving system reliability and stability.

71
Q

what is system authorization

A

form of objective assessment and formal acceptance of risk associated with the installation and operation of information systems, culminating in the explicit authorization of a system to operate prior to it being allowed to do so.

72
Q

what is the purpose of system authorization

A

provide an enterprise approach to the management of IT risk by ensuring that all information systems are reviewed to identify their associated risk and that this risk is either flagged or accepted prior to granting the system approval to operate

73
Q

List the two parts of a system authorization and describe

A
  • evaluation: process of reviewing an information system to determine the security of its design, development ,testing, deployment and operations. examination of the technical and non technical aspects of a system operations to ensure that the risk associated with the system has been identified and to document any mitigating controls that may be in place.
  • authorization: official decision by senior manager to approve an information system for operational use.
74
Q

what should an assessment inventory include

A

all equipment, supplier ,acquisition date, original cost, actual cost, location, owner of the equipment and other data required for maintenance, insurance and warranty purposes.

75
Q

what is the goal of configuration management?

A

have a single approved way in which particular systems or devices intended for a particular role should be configured for use by the organization.
use of a common configuration makes it easier to deploy new system, test patches and upgrades, identify the presence of malware and manage the enterprise.

76
Q

what are best practices for configuration management

A
  • hardening the system
  • policies and procedures in place for config management
  • backup of standard configuration available
77
Q

list some third party management strategies

A
  • ensuring that security requirements and regulation for handling information has been written into the outsourcing agreement and are followed.
  • right to audit the process of the outsource supplier or an attestation from the supplier that validates compliance
  • attestation by external auditors of the supplier or an independent review
78
Q

describe the process of data validation

A
  • range checks = e.g. allowable data values
  • format checks = e.g. configuration of date
  • special character checks = e.g. prevent script commands
  • size : e.g. prevent buffer overflows or incomplete data
  • likelihood: entries of correct form that are statistically unlikely and suggest an error.
79
Q

how can data validation be accomplished

A

e.g. with a white list of allowed data or a blacklist of prohibited data.

white list = preferred when environment is based on static or infrequently changing values.

blacklist = useful in environments in which the range of valid is extremely broad but in which only a few known values should be prohibited.

80
Q

describe data protection strategies that will ensure change will not affect the integrity, precision or accuracy of the data or of data processing options

A
  • data checks and balances of input compared to output
  • checks of normal compared to abnormal levels of processing
  • anti malware detection software
  • SoD defined at every level of a system or application
  • processes requiring approval for transactions
81
Q

what is identity management?

A
  • the process of managing the identities of the entities (users, processes, etc) that require access to information or information systems. e.g least privilege
82
Q

what is SoD

A

basic internal control that prevents or detects errors and irregularities by assigning to separate individuals the responsibility for initiating and recording transactions and for the custody of assets.

83
Q

describe how access control is managed

A
  • identification, authentication, authorization and accountability
84
Q

describe identification

A

unique identifier to every individual and process that has access to a system and allows for tracking and logging of the activity by the user and the possibility to investigate a problem if it were to arise. usually provided through a user id , account number.

85
Q

describe authentication

A

process of validating an identity. authentication is done using three methods

  • knowledge: know password
  • ownership; use of an ID badge
  • characteristics; biometrics, eg, fingerprints
86
Q

what is node authentication

A

authentication of a device or location

87
Q

what is authorization?

A

refers to the privileges or permissions the person will have, including read-only, write only, etc

88
Q

describe accountability/auditing

A

action logs or records the activity on a system and indicates the user ID responsible for the activity

89
Q

what are the benefits of encryption?

A
  • confidentiality: makes data unreadable to anyone who is unauthorized.
  • integrity: prove that the content has not been changed, the identity of the sender or both
  • proof or origin
  • access control
  • authentication
90
Q

list the type of encryption and describe?

A
  • symmetric : uses the same secret key to encrypt and decrypt . less complicated and uses less processing power. good for bulk data encryption.
  • asymmetric : uses public and private key to encrypt and decrypt data.
91
Q

what are disadvantages of symmetric encryption?

A
  • not easy for party A to deliver keys to party B.

- no way to be sure which participant in a given key network originated a particular message

92
Q

what is a disadvantage of symmetric encryption ?

A
  • computationally intensive and slow. common to use this method to distribute symmetric keys
93
Q

list some methods used to detect accidental errors in data transmission?

A
  • parity bits, checksums and cyclic redundancy checks
94
Q

what is hashing?

A

mathematical transformation of data using an algorithm whose result is predictable, repeatable and entirely dependent upon the content of the message and of a fixed length. it provides effective protection against accidental changes in a message, such as those caused by interference.

95
Q

what is a digest?

A

the value created by a hash algorithm

96
Q

what is a digital signature

A

combines a hash function with the asymmetric encryption ability to verify the authors identity.

promotes non repudiation . however, only a message that is both signed and encrypted is simultaneously afforded CI and non repudiation.

97
Q

what is the purpose of certificates

A

to link a public key with a specific owner by relying on the verification of a trusted third party known as the CA authority.

98
Q

what is a PKI?

A

refers to the overall implementation of public key cryptography, including certifications and the CA’s needed to issue or verify them.

99
Q

list some ways to manage vulnerabilities associated with platforms and operating systems

A
  • use trusted vendors or suppliers
  • purchasing equipment that has been tested and evaluated by an external entity
  • validate that maintenance hooks or back doors have been secured
  • reset all passwords and change default accounts
  • implement strict controls over changes, patches and configurations
  • devices should be hardened
100
Q

describe application risk

A

due to flaws or bugs in the coding of the application.

101
Q

describe network security

A
  • network security includes ensuring that what is sent matches what is received (integrity).
  • that no unauthorized party has gained access to the information in transit (confidentiality)
  • that communication channels are available whenever needed (availability)
102
Q

how can network integrity be achieved

A
  • parity bits, checksums, hashing and digital signatures.
  • integrity tends to be important when dealing with data intended for use in transaction processing and is less important in time-sensitive processes such as voice and video traffic
103
Q

how is confidentiality of a network achieved

A
  1. encryption
    - encryption at the datalink layer used in cases of open air transmission = WIFI protected access 2
    - at the network layer = encapsulating security payload.
    - at the transport layer encryption = common for web based traffic. secure shell is another mechanism for transport layer security.
    - application layer encryption may be used if confidentiality is paramount.
  2. architecture of the network
104
Q

how is network segmentation achieved

A
  • firewall and gateway deployed in layers
105
Q

give some examples of devices used for layered defense

A
  • intrusion detection system and intrusion prevention systems
  • virtual area lan
  • bastion hosts
106
Q

what is a dmz

A

screened firewalled network segment that acts as a buffer zone between a trusted and untrusted network.

107
Q

how is network availability achieved?

A
  • providing multiple paths for data to travel so that communications remains possible even in the event of a partial network failure
  • e.g. alternate routing, redundancy of cables and network devices, load balancing

CRISC (5 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions