Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Security + Vocab > 5.0 Risk Management > Flashcards

5.0 Risk Management Flashcards

1
Q

An agreement that specifies what type of business partnership two entities will have; often this dictates other considerations, such as interconnection requirements and security.

A

BPA (Business Partners Agreement)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

A contractual agreement, signed by an organization and a third party provider, that details level of security, data availability, and other protections afforded the organization’s data held by a third party.

A

SLA (service Level Agreement)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

An agreement between two parties, usually either two businesses or two providers, that specifies the term of connecting their respective private network infrastructures.

A

ISA (Interconnection Security Agreement)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

A document that defines an agreement between two parties in situations where a legal contract is not necessary or appropriate, such as where both parties work for the same overall organization.

A

MOU/MOA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

A personal security concept that states a single individual should not perform all critical or privileged level duties.

A

Separation of Duties

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Organizational policy that describes both acceptable and unacceptable actions when using organizational computing resources, as well as the consequences of unacceptable use.

A

Acceptable Use Policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

The maximum amount of time that a resource may remain unavailable before unacceptable impact on other system resources occur.

A

RTO (recovery Time Objective)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

The maximum amount of data that can be lost for the organization, after which the business cannot recover or would suffer significant loss.

A

RPO (Recovery Point Objective)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

A numerical value estimate for a piece of hardware or equipment that indicates how much time likely will pass between major failures of that hardware or equipment.

A

MTBF (Meantime Between Failure)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

A numerical estimate for a piece of hardware or equipment that indicates the likely time between the point a component fails and the time it can be recovered, either through repair or replacement.

A

MTTR (Meantime To Recover)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

A system component that has no backup, redundancy, or fault tolerance, such that if the component fails, the entire system fails.

A

SPOF (Single Point of Failure)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Natural disaster outside the control of humans.

A

Environmental Threat

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Any threat that is not environmental.

A

Manmade

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Threat that is generated by internal sources, usually an insider to the organization.

A

Internal

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Threat generated from outside of your infrastructure.

A

external

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

The monetary value of any single loss. It is used to measure risk with ALE and ARO in quantitative risk assessment.

SLE x ARO= ____

A

SLE (single Loss Expectancy)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

The expected loss for a year. It is used to measure risk with ARO and SLE in quantitative risk assessment.

SLE x ARO =_____

A

ALE (Annual Loss Expectancy)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

The number of times a loss is expected to occur in a year. It is measured with risk using ALS and SLE in a quantitative risk assessment.

A

ARO (annualized rate of occurrence)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

An element of risk assessment. It identifies the value of an asset and can include any product, system, resource, or process. The value can be a specific monetary value or subjective value.

A

Asset Value

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

A document listing information about risks. It typically includes risk scores along with recommended security controls to reduce the risk scores.

A

Risk Register

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

A risk assessment that uses specific monetary amounts to identify cost and asset value. It then uses SLE and ARO to calculate ALE.

A

Quantitative Risk Assessment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

A risk assessment that uses judgment to categorize risks. Its based on impact and likelihood of occurrence.

A

Qualitive Risk Assessment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

A strategy of dealing with risk in which it is decided the best approach is simply to accept the consequences should the threat happen.

A

Risk Acceptance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

A strategy of dealing with risk in which it is decided that the best approach is to offload some of the risk through insurance, third-party contracts, and/or shared responsibility.

A

Risk Transference

25
Q

A strategy of dealing with risk in which it is decided that the best approach is to avoid the risk.

A

Risk Avoidance

26
Q

A strategy of dealing with risk in which it is decided that the best approach is to lessen the risk.

A

Risk Mitigation

27
Q

The process used to prevent unauthorized changes. Unauthorized changes often result in unintended outages.

A

Change Management

28
Q

The procedures documented in an incident response policy.

A

Incident Response Plan

29
Q

A term that refers to the order in which you should collect evidence.
Ex: data in memory is more volatile than data on a disk drive, so it should be collected first.

A

Order of Volatility

30
Q

A process that provides assurances that evidence has been controlled and handled properly after collection. Forensic experts establish this when they first collect evidence.

A

Chain of Custody

31
Q

A court order to maintain data for evidence.

A

Legal Hold

32
Q

A complete backup facility to continue business operations that includes all resources in place, computers, network infrastructure and current backups , so that operations can commence in hours or even minutes after a disaster occurs.

A

Hot-site

33
Q

A site that provides some capabilities in the event of a disaster. The organization that wants to use a warm site will need to install, configure, and re-establish operations on systems that might already exist in the warm site.

A

Warm-site

34
Q

A physical site that can be used if the main site is inaccessible (destroyed) but that lacks all of the resources necessary to enable an organization to use it immediately.

A

Cold-site

35
Q

A type of backup that includes only new files or files that have changed since the last full backup. Differential backups differ from incremental backups in that they don’t clear the archive bit upon their completion.

A

Differential Backup

36
Q

A type of backup that includes only new files or files that have changed since the last full backup and then clears the archive bit upon completion.

A

Incremental Backup

37
Q

Image of a virtual machine at a moment in time.

A

Snapshot

38
Q

A backup that copies all data to the archive medium.

A

Full Backup

39
Q

An exercise that involves individuals sitting around a table with a facilitator discussing situations that could arise and how best to respond to them.

A

Tabletop Exercise

40
Q

The process of reconstructing a system or switching over to other systems when a failure is detected.

A

Failover

41
Q

Security controls that attempt to discourage individuals from causing from causing a security incident.

A

Deterrent Control

42
Q

Security controls that attempt to detect security incidents after they have occurred.

A

Detective Control

43
Q

Security control that attempts to prevent a security incident from happening.

A

Preventative Control

44
Q

Security controls that attempts to reverse the impact of a security incident.

A

Corrective Control

45
Q

Security controls that are alternative controls used when a primary security control is not feasible.

A

Compensating Control

46
Q

Controls that rely on technology.

A

Technical Control

47
Q

A control implemented through administrative policies or procedures.

A

Administrative Control

48
Q

Controls and countermeasures of a tangible nature intended to minimize intrusions.

A

Physical Control

49
Q

To burn any flammable data

A

Burning

50
Q

To shred any data.

A

Shredding

51
Q

a process that is performed after shredding papers. It reduces the shredded paper to a mash or puree.

A

Pulping

52
Q

To completely smash a Hard Disk.

A

Pulverizing

53
Q

Using a powerful electromagnet to wipe the data and make it useless.

A

Degaussing

54
Q

A general sanitization term indicating that all sensitive data has been removed from a device.

A

Purging

55
Q

The process of completely removing a;; remnants of data on a disk. A bit-level overwrite writes patterns of 1s and 0s multiple times to ensure data on a disk is unreadable.

A

Wiping

56
Q

Information that is unique to an individual and may serve to identify an individual.
Ex: SSNs, Bank Account info, names and addresses, and birthdates.

A

PII

57
Q

Specific information related to an individual s healthcare that is protected by law both as an individual data elements and in aggregate.
Ex: medical diagnosis, conditions, or treatment, as well as billing or insurance information.

A

PHI

58
Q

A policy stating how long data should be kept (retained).

A

Data Retention

Security + Vocab (9 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions