Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Professor Messer > 5.2 > Flashcards

5.2 Flashcards

Risk management, risk analysis, risk management strategies, business impact analysis

1
Q

A type of risk assessment that occurs before a particular project starts, to help better understand the risks of that project.

A

One-time

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

A type of risk assessment that occurs every time the change control process is implemented.

A

Continuous

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

A type of risk assessment that occurs for one specific purpose. The scope of this type of assessment is very narrow.

Ex. A specific new attack type

This type of assessment proceeds by creating a committee to perform a risk assessment of that one specific thing. After that, the committee is disbanded.

A

Ad hoc

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

A type of risk assessment that is performed in a specified schedule. This assessment is done internally, without the need of a third-party.

This assessment might also be mandated by governmental regulations to ensure compliance.

A

Recurring

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

A type of risk assessment that uncovers underlying reasons and context of each risk, including ARO, impact, cost of controls, and overall risk value.

A

Qualitative

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

A type of risk assessment that measures and quantifies specific variables, such as AV, EF, and SLE, ALE, and ARO.

A

Quantitative

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

SLE stands for

A

Single Loss Expectancy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

AV stands for
(not antivirus)

A

Asset Value

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

ALE stands for

A

Annualized Loss Expectancy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

EF stands for

A

Exposure Factor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

The value of the asset to the organization

Includes cost, effect on company operations, potential regulatory fines, etc.

A

AV

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

The percentage of the value lost due to an incident

Losing a quarter of the value is 0.25, losing the entire asset is 1.0, etc.

A

EF

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

How likely a threat is to occur in a year

A

ARO

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

The monetary loss if a single event occurs

A

SLE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

The monetary loss to incidents within a year

ARO x SLE

A

ALE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

5 types of impact you should consider during risk assessment

A

Life
Property
Safety
Finance
Reputation

17
Q

Difference between risk likelihood and risk probability

A

Risk likelihood is a qualitative measurement of risk. “Rare, possible, almost certain,” etc.

Risk probability is a quantitative measurement of risk. It is statistical and can be based on historical performance.

18
Q

A broad description of risk-taking deemed acceptable.

The amount of accepted risk before taking any action to reduce that risk.

A

Risk appetite

19
Q

Difference between risk appetite and risk tolerance

A

Risk appetite is a broad-sweeping description.
For example, the govt puts up speed limits and you are not, under any circumstances, allow to go above that limit.

Risk tolerance is the acceptable deviation from the level set by the risk appetite and business objectives.
For example, most police officers only give you a speeding ticket if you go 5+ miles over the speed limit.
Or, if there is bad weather, you might be expected to drive a lot slower than the speed limit.
Or if you’re having a medical emergency, police officers might even escort you at higher speeds to the hospital.

20
Q

A detailed list of risks associated with implementing a project

May provide options or solutions to avoid or mitigate those risks. Includes key risk indicators, risk severity, and risk owners.

A

Risk register

21
Q

Metrics that predict potential risks that can negatively impact business.
Ex. Turnover rate, employee satisfaction, number of applicants per job, etc.

Typically appear in a risk register as the risk description.
Ex. “Project design and deliverable definition is incomplete.”

A

Key risk indicators

22
Q

The person listed on a risk register who is responsible for managing a particular risk

A

Risk owner

23
Q

A measure of the level of risk exposure above which action must be taken to address risks proactively, and below which risks may be accepted.

In other words, it helps to determine whether taking action against the risk is worth it. Will mitigating the risk be more costly than just accepting it?

A

Risk threshold

24
Q

A risk management strategy where you move the risk to a third party

Ex. a cybersecurity insurance company

A

Transferrence

25
Q

A risk management strategy where you do nothing to mitigate or avoid the risk

A

Acceptance

26
Q

A risk management strategy where you accept the risk with approval to not follow certain policies or regulations at all.

Ex. A third-party supplier says that they do not provide or support patches to their firmware.

A

Acceptance with exemption

27
Q

A risk management strategy where you accept the risk, and also allow a one-time instance of not following policies or regulations.

Ex. The policy is to have vulnerabilities patched within 3 days of vulnerability discovery. But this specific patch causes critical software failures, so you don’t enforce the rule this time.

A

Acceptance with exception

28
Q

A risk management strategy where you stop participating in the risky activity.

A

Avoidance

29
Q

A risk management strategy where you decrease the risk level.

A

Mitigation

30
Q

A formal list of all risks that a company is tracking as well as their descriptions and how to handle them.

Commonly referenced by upper management.

A

Risk report

31
Q

Difference between risk report and risk register

A

Risk report is all the risks that an organization is tracking.

Risk register tracks only the risks for a specific project.

32
Q

RTO stands for

A

Recovery Time Objective

33
Q

RPO stands for

A

Recovery Point Objective

34
Q

MTTR stands for

A

Mean Time To Repair

35
Q

MTBF stands for

A

Mean Time Between Failures

36
Q

The maximum acceptable amount of time for restoring a network or application and regaining access to data after an unplanned disruption.

A

RTO

37
Q

The measurement of how much data - measured in time - that a company MUST have in order to be considered up and running after an incident has occurred.

Ex. The database must have at least the last 12 months of data to be considered fully functional.

It defines how much data loss is acceptable.

A

RPO

38
Q

The average amount of time it takes to resolve a problem.

Includes diagnosing the problem, replacing equipment, and configuring new equipment.

A

MTTR

39
Q

The average amount of time between repairable outages.

Can be calculated as total uptime divided by number of breakdowns, or be based upon historical data.

A

MTBF

Professor Messer (49 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions