Ch1 Risk Management Flashcards
The CIA of cyber security stands for
Confidentiality; Integrity; Availability
a threat is defined as
an action or event that exploits a vulnerability
risk = ___ x ___
threat x vulnerability
priority risk management addresses high ___ and high ___ first
high impact and high vulnerability
impact is defined as
actual harm caused by a threat
for risk assessment, NIST stands for
national institute of standards and technologies
main document used for risk assessment
NIST 800-30
4 attributes of threat actors
internal/external; sophistication; resources; intent
social media and public records are considered ___ by threat actors
open source intelligence (OSINT)
6 types of threat actors
script kiddies; hacktivists; organized crime; nation-states; insiders; competitors
2 framework documents used in vulnerability assessment
NIST 800-37 and ISACA Risk IT
program used for more detailed vulnerability assessment
Nessus
vulnerability assessment done by a 3rd party
penetration (pen) testing
4 types of threats in threat assessment
adversarial; accidental; structural; environmental
4 responses to risk
mitigate; transfer; accept; avoid
a security control is a ____ we apply to ____ problems
mechanism/action; protect against or remediate
3 security control categories
administrative; technical; physical
5 security control functions
deterrent; preventative; detective; corrective; compensating
having two internet service providers for security reasons is an example of…
vendor diversity
layered security uses diversity and ____
redundancy
defense in depth uses what 2 types of diversity?
vendor; combining security control categories (physical, technical, administrative)
4 levels governing IT security
laws and regulations; [industry] standards; best practices; common sense/experience
roles and responsibilities are assigned by an organizations _____
policies
step by step instructions for implementing policy are ___
procedures
_______ policy governs what you can store on a company computer
acceptable use
______ policy governs categories of data
data sensitivity and classification
_______ policy governs password use, fobs, categories you have access to…
access control
______ policy governs password requirements (length, complexity…) and how to reset it
password
______ policy governs how you maintain company property and when you can use it
care and use of equipment
_______ policy governs personal customer information and some company information as well
privacy
_____ policy governs background checks, security clearance, job rotation, etc.
personnel
national standard for risk management and regulatory framework document
NIST SP800-37
6 steps in the NIST SP800-37 framework
categorize; select; implement; assess; authorize; monitor
international risk management framework document
ISO 2700
asset value calculation adds what values?
replacement/repair cost + lost revenue
exposure factor =
% of asset lost due to an incident
single loss expectancy (SLE) =
asset value x exposure factor
if we expect a flood every 20 years, its ____ is .05
annualized rate of occurrence (ARO)
asset value x exposure factor =
single loss expectancy (SLE)
annualized loss expectancy (ALE) =
single loss expectancy (SLE) x annualized rate of occurrence (ARO)
how much time we expect it to take to repair a component
mean time to repair (MTTR)
how much time we expect it to take for a component to fail
mean time to failure (MTTF)
total time we expect to pass from one component failure to the next, including repair time
mean time between failures (MTBF)
in impact analysis, a ____ is where one thing going down screws up everything else
single point of failure
how can single points of failure be addressed in impact analysis?
defense in depth (diversity and redundancy)
what are the 4 categories of business impact analysis?
property; financial; life/safety; reputation
________ is the amount of time a critical system can be down before substantial impact
recovery time objective (RTO)
_______ is the amount of data that can be lost before substantial impact
recovery point objective (RPO)
what are the 4 main types of data for security purposes?
public; confidential; private; proprietary
data protected by non-disclosure agreements is an example of _____ data
confidential
SSN and DOB are examples of ____ data
private
trade secrets are examples of ____ data
proprietary
medical records are considered ____
protected health information (PHI)
information that can be used to reliably identify you is ____
privately identifiable information (PII)
the data ___ has all legal responsibility for the data
owner
the ____ has the ability to delete an entire collection of data, but doesn’t make other decisions about it
system administrator
an ____ makes strategic decisions about a collection of data
executive user
a _____ has increased access to data, and can delete some of it
privileged user
_____ is when a new employee is introduced to company policies and procedures, perhaps signs an NDA, etc.
onboarding
_____ is when an employee’s accounts are closed, and any credentials returned
offboarding
document covering Privately Identifying Information (PII)
NIST 800-122
the 3 main personnel management controls are:
mandatory vacations; job rotation and separation of duties
which 3rd party agreement governs two companies working together, creating financial and management ground rules?
Business Partner’s Agreement (BPA)
which 3rd party agreement governs terms and warranties of services provided?
Service Level Agreement (SLA)
which 3rd party agreement typically is used in government contracts?
Interconnection Security Agreement (ISA)
which 3rd party agreement is not an actual contract, but typically accompanies one?
Memorandum of Understanding/Agreement
the _________ implements security controls for a network
system admin
the _______ defines access to the data on a system
data owner
the ________ decides who will be the system admin
system owner
the ______ in a system is the front line in monitoring and reporting security breaches
user
the head of accounting would be a _______ in a data system
privileged user
a ________ can see all the data in a system, but in read-only format
executive user
