10 - Risk Management

Question 1

Why do we need risk assessment

Answer 1

• Avoid doing same mistakes
• Know how many resources to use and how (GDPR, testing etc)

Question 2

5 steps to security

IIDIC

Answer 2

• Identify the target
• Identify the source of insecurity
• Determine the threats
• Implement measures that protect assets in a cost effective manner
• Continuous review

Question 3

Risk Management vs Risk Assessment

Answer 3

Risk assessment is the identification phase
Risk management includes assessment AND implementation

Question 4

Risk is a function that takes into account?

Answer 4

THreat, Asset and vulnerability

Question 5

Risk management meaning

Answer 5

• Minimisation of risks
• Control affects of risks

Question 6

Techniques of risk management

AMCTAR

Answer 6

• Avoidance
• Mitigation
• Cost Benefit analysis
• Transfer (the risk to 3rd party)
• Acceptance
• Residual Risk

Question 7

Risk
Inappropriately configed firewall rule set allows unauth LAN access

Avoid:
Reduce:
Transfer

Answer 7

Avoid: Periodic review of firewall
Reduce: Install IDS: weekly scanning
Transfer: Outsource net management

Question 8

Risk assessment: List based on asset or threat

Answer 8

Asset

List each asset THEN the threat to it

Question 9

3 Challenges of Risk Assessment

SIE

Answer 9

• Static process for moving target
• Information availability
• Estimating the impact

Question 10

Quantitiative Risk Assessment vs Qualitative

Answer 10

• Quantitative: Calculates absolute financial values, losses and costs
• Qualitative: Calculates relative values, losses and costs

Question 11

Risk between likelihood and impact

Answer 11

Imagine 3x3 grid with impact and likelihood

Question 12

First thing you try to test a vulnerability

Answer 12

pen testing

Question 13

Risk ID: Threats to consider (… or …_

Answer 13

• External or internal
• Natural or manmade
• Intentional or accidental

Question 14

Risk ID: Identifying vulnerabilities

Answer 14

• Audit
• Certification/accreditation records
• Sys logs
• prior events
• trouble reports
• incident response teams

Question 15

Threat and vulnerability paired = ____

Answer 15

Threat Action showing the impact

Question 16

Prior to conducting risk assessement:

Answer 16

• Identify assessment scope (mission)
• Review previous findings

Question 17

Identifying assets and activites

Answer 17

Make a list and prioritise

Question 18

List of assets to consider:

Answer 18

• Physical
• Hardware
• Software
• Personnel (eg is a job done by just one person)
• Data and information

Question 19

Internal assessments

Answer 19

Security pros exploit internal systems to learn about vulnerabilties

Question 20

External assessments

Answer 20

Personnel outside the company exploit systems to learn

Question 21

Procedure for vulnerability assessment

Answer 21

• Documentation
• Review logs
• Vulnerability scans and other assessment tools
• audit and personnel interviews
• System testing
• Verifying user rights and permissions

Question 22

Exploit assessments

Answer 22

Attempt to simulate an attack to see if it can succeed.

Question 23

2 Different controls

Answer 23

In-place (in the operational system)
Planned (in documents)

Question 24

Control classes

Answer 24

Procedural
Technical
Physical

Question 25

Procedural Class examples

Answer 25

• Policies
• Security Plans
• Insurance
• Awareness and training

Question 26

3 Technical Class examples

Answer 26

• Login identifier
• System logs
• Firewalls

Question 27

Physical Class examples

Answer 27

• Locked doors
• Video cameras
• Fire detection

Question 28

WannaCry 2017

Answer 28

NHS using outdated and unpatched Win7/WinXP versions
They had been warned a year before
Lack of clear disaster recovery plan

Question 29

Hive Ransomware

Answer 29

Vulnerability in Microsoft’s Exchange Server (ProxyShell)
Over 1,500 victims