Chapter 1 Flashcards
Risk Assessment
Deals with threats, vulnerabilities, and impacts of a loss of information processing capability or a loss of information itself
Vulnerability
weakness that can be exploited by a threat
Key components of the risk assessment process
Risks to which the organization is exposed
Risks that need addressing
Coordination with BIA
Risks to which the organization is exposed
Develop scenarios that can help deal with risks as they occur
Risks that need addressing
Deciding which risks are likely and unlikely
Coordination with BIA
Business impact analysis provides an accurate picture of the threats facing the organization
ALE
Annual Loss Expectancy - expected monetary loss per year
SLE
Single Loss Expectancy - monetary amount lost at one time.
Two components of SLE
AV - Asset Value
EF - Exposure Factor
ARO
Annual Risk of Occurence - Likelihood of an event occuring within a year. Often drawn from historical data
What is the formula used for Risk Assessment?
SLE * ARO = ALE
Threat Vector
Method used by attacker to compromise assets
MTBF
Mean Time Between Failures - Anticipated lifetime of a component. Used for items that can be repaired
MTTF
Mean time to failure - Used for components that cannot be repaired
MTTR
Mean time to restore (or repair) - average downtime for a component
RTO
Recovery Time Objective - the maximum acceptable amount of time that a component can be down.
Beyond this time, outage negatively affects business.
Agreed upon in BIA
RPO
Recovery Point Objective - What point (time or version) of the system will be recovered? The more recent the more expensive
Five approaches to identified risks
Risk Avoidance Risk Transference Risk Mitigation Risk Deterrence Risk Acceptance
Risk Avoidance
Not engaging in the risky activity
Risk Transference
Insurance policy (sharing risk)
Risk Mitigation
Taking measures to decrease the likelihood of an adverse event (antivirus programs)
Risk deterrence
Posting warnings, setting up and publicizing negative consequences for the attacker
CompTIA Risk Mitigation specifics
Audits of user rights and permissions
change management
incident management
DLP systems
DLP system
Data Loss Prevention
Platform as a service
vendors allow apps to be created and run on their infrastructure
Software as a service
Applications run over the web
Infrastructure as a service
Virtualization
Risks of cloud computing
Regulatory Compliance
User Privileges
Data Integration/Separation
Hypervisor
Software that hosts the virtual machines
Risks associated with Virtualization
Breaking out of the VM
Network and Security Controls intermingle
A good policy has a ______ that outlines what the policy intends to accomplish
Scope Statement (sentence)
Policy Overview Statement
Provides the goal of the policy, why it is important and how to comply with it. (paragraph, checklist, bulleted list)
Accountability Statement
Addresses who is responsible (by their position) for enforcement
Exception Statement in a policy
Addresses how to deviate from the policy, e.g. who to contact for authorization
Standard
Derived from policies, more specific than policies
Scope and purpose of a standards document
Describes the intention of the standards document
Key points of a standards document
Scope and Purpose Roles and Responsibilities Reference Documents Performance Criteria Maintenance and Administrative Requirements
Roles and Responsibilities (Standards Document)
Who is responsible for implementing, monitoring and maintaining the standard
Reference Documents (standards Doc)
Explains how the standard relates to different policies
Performance Criteria (standards document)
Outlines how to accomplish the task
Maintenance and Administrative Reqs (standards document)
manage and administer systems and networks. Example: how often to change passwords
Guidelines
Less formal than Policies or Standards, helps to follow policies and standards
Guideline Document sections
Scope and Purpose
Roles and Responsibilities
Guideline Statements
Operational Considerations
Scope of a guideline or standard
Which employees it applies to
Guideline statements
step by step instructions
Operational Considerations (guidelines document)
what duties are required and at what intervals e.g. backups
Acceptable Use Policies
How employees can use systems and resources, with consequences for misuse
pod slurping
getting files from a network through USB or cloud drives
Type I error
False Positive - False Alarm (positive is preferable)
Type II error
False Negative - missed a threat
