Week 4 Flashcards
(20 cards)
What is the formula for risk in Information Security?
Risk = Likelihood x Impact
What three elements does component-driven risk assessment evaluate?
Threat, Vulnerability, Impact
Give examples of threats in risk analysis
Lone hacker, state-sponsored group, staff error, severe weather
Name three risk assessment methods/frameworks
NIST 800-30, ISO/IEC 27005, ISACA COBIT
Name two information security management frameworks
NIST Cybersecurity Framework, ISO/IEC 27000 series
What are the four risk control strategies?
Avoid, Accept, Reduce, Transfer
What are the steps of the ISO/IEC 27005:2011 risk assessment process?
Identify (assets, threats, controls, vulnerabilities, consequences); Analyse (consequences, likelihood); Treat (modify, retain, avoid, share); Monitor
What is qualitative risk analysis?
Uses descriptive scales (e.g. VL, L, M, H, VH) for likelihood and impact
What is a major advantage and disadvantage of qualitative risk analysis?
Advantage: Easy to understand;
Disadvantage: Subjectivity in scale
What is quantitative risk analysis?
Uses numerical data to measure impact and likelihood
What are pros and cons of quantitative risk analysis?
Pros: Data-driven, directly related to objectives;
Cons: Data gaps, overconfidence in results
What does ALE stand for and how is it calculated?
Annualized Loss Expectancy = SLE x ARO
Define SLE and ARO in risk analysis
SLE: Single Loss Expectancy
ARO: Annualized Rate of Occurrence
What is the Cost Benefit Analysis (CBA) formula in security?
CBA = ALE(prior) - (ALE(post) + ACS)
What is ACS in cost-benefit analysis?
Annualized Cost of Safeguard
What are the four risk treatment options?
Retain (Accept), Avoid (Terminate), Share (Transfer), Modify (Reduce)
Why is risk management a continual process?
Because threats, vulnerabilities and impacts evolve over time
What are some limitations of current risk frameworks?
Over-reliance on on reductionist views, static models, subjectivity, noise, and data bias
What is a ‘simple risk matrix’ used for?
Visual tool for evaluating everyday risks using likelihood and impact
What does the critical appraisal by NCSC suggest about frameworks?
Effectiveness depends on thoughtful application, not just the method itself.
