Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

04. CISM - Chapter 4 - Information Security Risk Response > 01. Risk Treatment / Risk Response Options > Flashcards

01. Risk Treatment / Risk Response Options Flashcards

1
Q

Risk treatment / Risk response

Represents the actions that the organisation undertakes to reduce risk to an acceptable leve

A

Risk treatment

176

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Risk treatment / Risk response

4 risk treament options

A
  1. Mitgation
  2. Transfer
  3. Avoidance
  4. Acceptance

176

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Risk treatment / Risk response

Brining in an external competent firm to perform anorganisations risk assessment is the best solution to help identify…

A

unknown unknowns

176

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Risk treatment / Risk response

In an enterprise environment, not all risks can be mitigated or eliminated because…

A

there are not enough resources to treat them all

177

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Risk treatment / Risk response

A strategy is needed for choosing the best combination of solutions that will reduce risk by…

A

the greatest possible margin

177

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Risk treatment / Risk response

A security manager making risk treatment decisions runs the risk of others in the organisation…

A

not supporting their decisions

177

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Risk treatment / Risk response

A security steering committee making a decisions about risk treatment represents..

A

a consensus decision and often the best choice

When stakeholders are involved in risk matters, they are more likely to support decisions affecting them

177

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Risk mitigation

Involves the implementation of some solution that will reduce an identified risk

A

Risk Mitigation

177

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Risk mitigation

An orgnisation will usually make a decision about implementing some form of risk mitigation after performing a..

A

cost analysis to determine if the reduction of risk is worth the expenditure of risk mitigation

177

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Risk mitigation

Security managers need to monitor risk mitigation activities carefully to ensure that…

A

they are completed as planned and not forgotten about

178

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Risk mitigation

Controls and risk assessments are tightly coupled in the…

A

risk management lifecycle

178

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Risk Transfer

The means by which some or all of the risk is transferred to some external entitiy

A

Risk Transfer

178

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Risk Transfer

Risk trasnfer is selected when an organisation does not have the..

A

operational or financial capacity to accept the risk and when risk mitgiation is not the best choice

178

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Risk Transfer

Risk transfer typically works with only a portion of the risk and it does not..

A

reduce all of the risk

179

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Risk Avoidance

The process by which the organisation abandons the risk inducing activity, such as taking an asset out of service

A

Risk avoidance

179

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Risk Acceptance

A process by which an organisation finds the presence of a risk to be acceptable and determines that it does not require reduction or mitigation

A

Risk acceptance

180

17
Q

Risk Acceptance

2 conditions by which an organisation may elect to accept risk

A
  1. Cost of risk mitigation is greater than the value of the asset being protected
  2. Impact of compromise is low, or the value or classification of the asset is low

180

18
Q

Risk Acceptance

Once a risk is accepted, it should not be closed but should be reviewed at least…

A

annually

  • Value of the asset or business might change throughout the year
  • Threats might have changed throughout the year
  • Cost of mitigation might have changed throughout the year

180

19
Q

Evaluating Risk Response Options

Factors for a risk manager to consider when evaluation risk response options

A
  1. Cost and effectiveness of response option
  2. Effectiveness of the control
  3. Organisational structure/design
  4. Governance
  5. Culture

  1. The value of an asset is less than the cost of the control to protect it
  2. If implemented controls do not reduce risk to an acceptable level, is it worth it?
  3. Organisational design and layouts divide the business - some departments may have more resources than others
  4. Legal and regulatory requirements
  5. Removing admin rights from people who complain as they do not want to give up what they had
20
Q

Cost and Benefits

Understanding the cost and benefits of risk mitigation helps the organisation to develope..

A

strategies that are more cost effective or result in greater cost avoidance

181

21
Q

Cost and Benefits

Organisations need to understaand several cost and benefit related considerations

A
  1. Change in threat probability
  2. Change in threat impact
  3. Change in operational efficiency
  4. Total cost of ownership (TCO)

  1. A mitigating control changes the probability of threat occurance
  2. The impact of a mitigated threat will change compared to a non mitigated threat, which brings a change in associated costs i.e. cost impact is less
  3. Mitigating controls may add time contraints or limits on operational teams
  4. The organisation understands the total cost of ownership from implementation, support, to end of life

181/182

22
Q

Cost and Benefits

A principle that is valid as a starting point for making cost-conscious decisions on risk mitigation

A

Proportionality

If an asset costs £10,000 but costs £20,000 to implement a control to reduce the risk, arguably it is not worth it.
If the asset however is integral to the process of the company making £100,000 revenue each day, this changes the balance in that the asset hardware value may not be much, but the asset value operationally is critical.

182

23
Q

Residual Risk

An element of risk that still exists after some of the risk has been removed through mitigation or transfer

A

Residual risk

182

24
Q

Residual Risk

Residual risk formula

A

Residual risk = Original risk - mitigated risk - transferred risk - avoided risk

182

25
Q

Iterative Risk Treatment

A mature way to approach residual risk is to…

A

analyse residual risk as if it were a new risk

Apply risk treatment and analsysis to the residual risk
One or more iterations of assessment may ultimately lead to the residual risk being accepted and the matter closed

183

26
Q

Risk Appetite, Capacity, and Tolerance

The level of risk that an organisation is willing to accept while pursuing its mission, strategy, and objectives before taking action to treat a risk

A

Risk Appetite

183

27
Q

Risk Appetite, Capacity, and Tolerance

the objective amount of loss that an organisation can tolerate without its continued existing being called into question

A

Risk Capacity

183

28
Q

Risk Appetite, Capacity, and Tolerance

The acceptable level of deviation in risk for a particular endeavor or business pursuit

A

Risk Tolerance

184

29
Q

Risk Appetite, Capacity, and Tolerance

The CISO is rarely the person making risk treatment decisions or being accountbale for that decision but is instead the…

A

facilitator of risk discussions that lead to risk treatment decisions

184

30
Q

Legal and Regulatory Considerations

In many cases, risk treatment decisions must abide by regulatory and legal requirements, including…

A
  1. Mandatory protective measures
  2. Optional protective measures
  3. Mandatory risk assessments

  1. Legal obligations to implement controls, whether the measure reduces actual risk or not - PCI DSS
  2. Organisations can chose not to implement a specific measure, but would require a formal, valid business reason not to.
  3. The mandatory requirement to conduct risk assessments, although does not necessarily mandate the neet to implement mandatory controls

185

31
Q

Legal and Regulatory Considerations

Any risk associated with any general or specific consequences of not being compliant with a law, regulation, or private legal obligation

A

Compliance risk

185

32
Q

Legal and Regulatory Considerations

Sometimes, executive management may chose to pay fines instead of bringing their organisation into compliance as…

A

fines or other sanctions may have lesser impact on the organisation than cost and effort ot be compliant

185

33
Q

RIsk Register

A business record that documents risks identified through risk assessments, risk analyss and other means

A

Risk Register

186

04. CISM - Chapter 4 - Information Security Risk Response (5 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions