5.4 Summarize risk management processes and concepts. Flashcards
Control Risk
Residual Risk
– Inherent risk + control effectiveness
– Risk that exists after controls are considered
– Some models base it on including additional controls
After adding a firewall or ID or IPS what is your risk.
Inherent Risk
– Impact + Likelihood
– Risk that exists in the absence of controls
– Some models include the existing set of controls
Without anything being put in place, there would be a certain amount of risk we would undertake. Even including your current set of controls.
Acceptance
Its a Business decision, we will accept the risk.
Risk Avoidance
Stop participating in high-risk activity
Transference
Choosing to purchase cyber security insurance.
Mitigation
Decrease risk level by investing in security systems.
Risk register
Identify and document the risk associated within eachstep of the project
Every project has a plan, but also has risk
– Identify and document the risk associated
with each step
– Apply possible solutions to the identified risks
– Monitor the results
Risk matrix/ Risk heat map
View the results of the risk assessment
– Visually identify risk based on color
– Combines the likelihood of an event with
the potential impact
– Assists with making strategic decisions
Risk appetite
– The amount of risk an organization is willing to take
Qualitative Risk assessment
Identify significant risk factors
– Ask opinions about the significance
– Display visually with traffic light grid or
similar method
Quantitative assessment
Likelihood
– Annualized Rate of Occurrence (ARO)
– How likely is it that a hurricane will hit?
In Montana? In Florida?
* SLE (Single Loss Expectancy)
– What is the monetary loss if a single event occurs?
– Laptop stolen (asset value or AV) = $1,000
* ALE (Annualized Loss Expectancy)
– ARO x SLE
– Seven laptops stolen a year (ARO) x
$1,000 (SLE) = $7,000
* The business impact can be more than monetary
– Quantitative vs. qualitative
Disaster Types
Environmental threats
– Tornado, hurricane, earthquake, severe weather
* Person-made threats
– Human intent, negligence, or error
– Arson, crime, civil disorder, fires, riots, etc.
* Internal and external
– Internal threats are from employees
– External threats are from outside the organization
RTO
Recovery time objective (RTO)
– Get up and running quickly
– Get back to a particular service level
Does not mean complete recovery, just to a certain time. Usually USD in conjunction with RPO.
RPO
Recovery point objective (RPO)
– How much data loss is acceptable?
– Bring the system back online; how far back
does data go?
The point at which we say we have recovered. This objective meats a certain set of requirements to say we have recovered enough.
