02. Risk Management Methodologies

Question 1

Risk Management Methodologies

Organisations select one or more standards for a variety of reasons

Answer 1

1. Regulatory requirements
2. Contractual requirements
3. Better standard alignment with organisation risk program and needs

134

Question 2

NIST Standards

NIST SP 800-30

Answer 2

A detailed, high quality standard describing the steps used for conducting risk assessments

134

Question 3

NIST Standards

NIST SP 800-39
Tiered multilevel risk management

Tiered Risk Management Lifecycle

Answer 3

Describes multilevel risk managment at different organisational levels;

Tier 1: Organisation View
Tier 2: Mission/business process view
Tier 3: Information systems view

134

Question 4

NIST Standards

NIST SP 800-39
Risk management process conists of several steps

Answer 4

Step 1: Risk Framing
Step 2: Risk Assessment
Step 3: RIsk Response
Step 4: Risk Monitoring

1. Assumptions, scope, tolerances, constracits, priorities
2. Threats and vulnerabilities are identified
3. Analysing risks and developing a strategy to educe risk
4. Performing periodic evaluation and identifying where risks are changing

135

Question 5

NIST Standards

NIST SP 800-30
Describes in greater detail a standard methodology for conducting a risk assessment

Answer 5

Step 1: Prepare for assessment
Step 2: Conduct assessment
Step 3: Communicate results
Step 4: Mantain assessment

135/136/137

Question 6

NIST Standards

NIST SP 800-30
Step 2: Conduct an assessment

Answer 6

1. Identify threat sources and events
2. Identify vulnerabilities and predisposing conditions
3. Determine likelihood of occurrence
4. Determine magnitude of impact
5. Determine risk

1. The standard uses a list of tables as a standard source of threat infomration
2. Organisation examines its environment; people, processes, technology
3. Organisation detemines the probability of a threat scenario occurring.
4. Risk manager determines the impact of each threat scenario happening
5. The organisation determines the level of risk for each threat event

136

Question 7

ISO/IEC 27005

ISO/IEC 27005
An international standard that defines a structured approach to risk assessments and risk management

Answer 7

Step 1: Establish context
Step 2: Risk assessment
Step 3: Risk evaluation
Step 4: Risk treatment
Step 5: Risk communications
Step 6: Risk monitoring and review

Question 8

Risk Management Methodologies

A vulnerability does not cause harm, but its presence may enable a..

Answer 8

threat event to harm an asset

138

Question 9

FAIR

Factor Analysis of Information Risk
(FAIR)

Answer 9

An anlysis method that helps a risk manager understand the factors that contribute to risk, the probability of threat occurrence, and estimation of loss

• defines 6 types of loss
• Focuses on concept of asset value and liability
• Guides risk managers through analysis of threat agents and the different ways they act

140

Question 10

FAIR

FAIR
Defines 6 types of loss

Answer 10

1. Productivity
2. Response
3. Replacement
4. Fines and judgements
5. Competitive advantage
6. Reputation

140

Question 11

FAIR

FAIR
Guides risk managers through an analysis of threat agents and the different ways in which a threat agent acts upon an asset

Answer 11

1. Access
2. Misuse
3. Disclose
4. Modify
5. Deny use

140

Question 12

ISACAs Risk IT Framework

ISACA Risk IT Framework:
Developed to align with COBIT. Broken down into 3 major process areas

Answer 12

1. Risk Governance (RG)
2. Risk Evaluation (RE)
3. Risk Response (RR)

141

Question 13

ISACA Risk IT Framework:

ISACA Risk IT Framework:
The risk evaluation (RE) is broken down into 3 areas (RE1 - RE3)

Answer 13

1. Collect Data (RE1)
2. Analyse Risk (RE2)
3. Maintain Risk Profile (RE3)

141