2.2_ Risk Management and Threat Modeling

Question 1

What’s the difference between a vulnerability, a threat, and a risk?

Answer 1

A vulnerability is an aspect of a business that can be exploited to compromise a system’s CIA.

A threat is an actor that might exploit a vulnerability.

A risk is a possibility of losing something valuable.

Question 2

A _________ is an aspect of a business that can be exploited to compromise a system’s CIA.

Answer 2

Vulnerability

Question 3

A _________ is an actor that might exploit a vulnerability.

Answer 3

Threat

Question 4

A _________ is a possibility of losing something valuable.

Answer 4

Risk

Question 5

Using the results of risk analysis to create a plan for preventing likely risks is called what?

Answer 5

Risk Management

Question 6

Understanding what risks face an organization, which are most severe, and which are most likely is called what?

Answer 6

Risk Analysis

Question 7

Determining which attacks an organization is most likely to experience, who is most likely to launch them, and what actions can be done to prevent them is called what?

Answer 7

Threat Modeling

Question 8

What is a business’s primary objective?

Answer 8

Profit

Question 9

_____________ and _____________ directly contribute to business profit.

Answer 9

Risk analysis and management and threat modeling directly contribute to business profit.

Question 10

_____________ helps business understand how much they’ll need to spend in the event of a given security break.

Answer 10

Risk Analysis

Question 11

_____________ results are shared upwards to the executives who make the major business decisions.

Answer 11

Threat Modeling

Question 12

When possible, risks are measured ___________ in financial figures, which businesses use to prioritize threats.

Answer 12

Quantitatively

Question 13

What does PASTA stand for?

Answer 13

It’s a Threat Modeling Methodology:

Process for Attack Simulation & Threat Analysis

Question 14

What does OWASP stand for?

Answer 14

Spoofing, Tampering, Repudiation, Information

Disclosure, DoS (Denial of Service), Elevation of Privilege

Question 15

What are the steps involved in the OWASP Threat Modeling process?

Answer 15

1. Determine assessment scope
2. Identify threat agents
3. Identify potential attacks
4. Identify exploitable vulnerabilities
5. Prioritize identified risks
6. Mitigate risks

Question 16

What is step 1 of the OWASO Threat Modeling process?

Answer 16

Determine Scope:

List the assets under consideration, determine their value, and define objectives for your threat modeling assessment.

Question 17

What is step 2 of the OWASO Threat Modeling process?

Answer 17

Identify Threat Agents:

Determine which attackers would be interested in the relevant assets.

Question 18

True or false:

Threat agents include a person or group that can produce a threat, whether or not that person or group is malicious.

Answer 18

True

Question 19

What is step 3 of the OWASO Threat Modeling process?

Answer 19

Identify Potential Attacks:

Identify the attacks each agent is likely to perform.

Question 20

_________ attackers use different modes of attacks and _________ attacks mean different risks and _________ considerations.

Answer 20

Different attackers use different modes of attacks and different attacks mean different risks and different considerations.

Question 21

If a client’s web application is taken offline by a DoS attack, the severity of the risk depends on which threat agent is responsible. What would be the difference between script kiddies and APTs?

Answer 21

Script kiddies might DoS a server simply to cause trouble.

An APT might DoS a server as a smokescreen to steal valuable data.

Question 22

___________ is the process of prioritizing threats identified in steps 1-4 based on their potential impact and likelihood.

Answer 22

Risk Analysis

Question 23

___________ is evaluating risk based on intangible, unmeasurable factors.

Answer 23

Qualitative Analysis

Question 24

Evaluating each risk based on its measured likelihood and impact is called what?

Answer 24

Quantitative Analysis

○ Likelihood: The probability of an event will take place.

○ Impact: The measure of the damage done if a risk takes place.

Question 25

When likelihood and impact cannot be accurately measured, you should do what type of analysis?

Answer 25

Quantitative Analysis

Question 26

_________ is used when a complex evaluation of cost vs. benefit is unnecessary. What’s an example?

Answer 26

Qualitative Risk Analysis

When a company is deciding between an inexpensive VPN service that logs traffic on its servers for internal use, and a more expensive service that does not keep any logs.

A bakery can use qualitative analysis to decide on an inexpensive VPN, since it shouldn’t matter much if they’re logging non-confidential information.

Question 27

You should use a ___________ when circumstances where intuitive analysis is insufficient.

Answer 27

Quantitative Risk Analysis

Question 28

To perform a ____________, analysts start by calculating how much it will cost if an asset is breached.

Answer 28

Quantitative Risk Analysis

Question 29

To perform a quantitative risk analysis, first, quantify _________ and _________.

Answer 29

First, quantify asset value and exposure factor.

Question 30

What does SLE stand for and what is?

Answer 30

Single Loss Expectancy (SLE)

SLE = AVE x EF

The estimated cost of the risk occurring on
a given asset.

Question 31

What does ARO stand for and what is it?

Answer 31

Annual Rate of Occurrence (ARO)

Estimated number of times the risk is
likely to occur in a given year.

Question 32

What does ALE stand for and what is it?

Answer 32

Annual Loss Expectancy (ALE)

Estimated cost of a risk reoccurring in a given year.

Question 33

What do AV and EF stand for

Answer 33

AV = Asset Value

EF = Exposure Factor

Question 34

The organization has the resources to respond to the breach immediately, without affecting day-to-day operations or revenue is what loss expectancy category?

Answer 34

Marginal

Question 35

The organization has the resources to respond to the breach, but may not be able to do so immediately. May experience interruptions to operations is what loss expectancy category?

Answer 35

Notable

Question 36

The organization experiences serious interruptions to operations, and doesn’t have the monetary and/or personnel resources to respond to effectively. May have to defer revenue, delay project timelines, reassign employees, and/or hire consultants to address the issue is what loss expectancy category?

Answer 36

Severe

Question 37

The organization suffers severe, lasting damage to its reputation and/or infrastructure. The future of the business is threatened by reputational damage, bankruptcy, being found in contempt of federal regulations, or other issues is what loss expectancy category?

Answer 37

Catastrophic