Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Secret > Chapter 1: IT Risk Identification > Flashcards

Chapter 1: IT Risk Identification Flashcards

1
Q

IT Risk Management Good Practices

A
  1. COBIT 5
  2. ISO/IEC 27005: 2011 - IT - Security techniques-Information security risk management
  3. ISO31000:2009- Risk Management Principles and Guidelines
  4. NIST Special Publication 800-30 Revision 1: Guide for Conducting Risk Assessments
  5. NIST Special Publication 800-39: Managing Information Security Risk
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Enumerate the ISO/IEC27005 Process Steps

A
  1. Context Establishment
  2. Risk Assessment
  3. Risk Identification
  4. Risk Analysis
  5. Risk Evaluation
  6. Risk Treatment
  7. Risk Acceptance
  8. Risk Communication and Consultation
  9. Risk Monitoring and Review
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

The IT Risk Management program should be:

A
  1. Comprehensive
  2. Complete
  3. Auditable
  4. Justifiable
  5. Legal
  6. Monitored
  7. Up to date
  8. Managed
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Ways to identify risk

A
  1. Historical or evidence-based methods
  2. Systematic approach (expert opinion)
  3. Inductive approach (theoretical analysis)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Enumerate the business related IT risk types

A
  1. Investment or expense risk
  2. Access or security risk
  3. Integrity risk
  4. Relevance risk
  5. Availability risk
  6. Infrastructure risk
  7. Project ownership risk
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Investment or expense risk

A

Risk that the IT investment fails to provide value for money or is otherwise excessive or wasteful

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Access or security risk

A

Risk that confidential or otherwise sensitive information may be divulged or made available to those without appropriate authority

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Integrity risk

A

Risk that data cannot be relied on because they are unauthorized, incomplete, or inaccurate

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Relevance risk

A

Risk associated with not getting the right information to the right people at the right time to allow the right action to be taken

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Availability risk

A

Risk of loss of service or risk that data are not available when needed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Infrastructure risk

A

Risk that the enterprise does not have an IT infrastructure and systems that can effectively support the current and future needs of the business in an efficient,cost - effective, and well-controlled fashion

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Project ownership risk

A

Risk of IT projects failing to meet objectives due to lack of accountability and commitment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Challenges in conducting interviews:

A
  1. Exaggeration

2. Inaccuracies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Important detail to obtain during the interview

A

the level of impact that previous incidents have had on the organization including how the incident was handled, results of post incident review and root cause analysis and current status of any noted remediation activities from prior activities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Risk culture

A

Reflects the balance between weighing the negative, positive, and regulatory elements of risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Risk culture elements

A
  1. Behavior toward taking risk
  2. Behavior toward policy compliance
  3. Behavior toward negative outcomes
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Symptoms of inadequate or problematic risk culture

A
  1. Misalignment between real risk appetite and translation into policies
  2. Existence of a blame culture
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Consequences of poor communication on risk:

A
  1. A false sense of confidence at all levels of the enterprise
  2. Lack of direction or strategic planning
  3. Unbalanced communication to the external world on risk
  4. The perception that the enterprise is trying to cover up known risk from stakeholders
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

IT Risk is…

A

the IT-enabled business risk that stems from the use of IT

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Senior management support

A

An important part of the risk management process

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Risk management depends on

A

business goals and objectives

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is a critical component of risk management?

A

History

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Merger or acquisition results in

A

emergence of new risks that creates uncertainty and stress. This can further result in poor judgment or inappropriate actions by personnel

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What influences the effectiveness of the risk management effort?

A

The positioning of risk management function within the organizational structure.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

In a large organization, the organization of the risk management group should follow…

A

the same model and the organization of the business continuity management team

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

RACI

A

Responsible
Accountable
Consulted
Infromed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

4 Main Types of Roles involved in the risk management process:

A
  1. Individuals responsible for managing risk
  2. Individuals accountable for the risk management effort
  3. Individuals who provide support and assistance to the risk management effort (consulted)
  4. Individuals who evaluate or monitor the effectiveness of the risk management effort
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

How does the RACI model help?

A

It can assist in outlining the roles and responsibilities of the various stakeholders. The purpose of the RACI model is to clearly show the relationships between the various stakeholders, the interaction between the stakeholders and the roles that each stakeholder plays in the successful completion of the risk management effort.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What is risk culture?

A

Set of shared values and beliefs that govern attitudes toward risk taking, care and integrity, and determines how openly risk and losses are reported and discussed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Ethics are related to…

A

An individual’s perception of right and wrong and are not necessarily linked to the law

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Ethics also applies to…

A

How people believe they have been treated

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Failure to comply with regulations may result in…

A

Financial penalties or loss of a license to operate as well as damage to the reputation of the organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

To ensure compliance, an organization must…

A

Have the ability to monitor and measure controls in use

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

In cases where there is noncompliance,

A

A justification for the reasons of noncompliance should be provided

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

When risk is considered on a system-by-system or project-by-project basis,

A

The result is a spotty risk solution that has many individually good efforts but no consistency or interoperability among the risk solutions that are implemented

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

The risk practitioner must be sensitive to the following before recommending a risk management approach or framework

A
  • local departmental cultures
  • priorities
  • regulations
  • restraints
  • goals
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

A critical part of establishing the risk management process is

A

The development and approval of a risk management policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

What is information security?

A

Protecting of information and information systems (including technology) from risk events

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

What is likelihood?

A

Likelihood = Probability. The measure of frequency of which an event may occur and is used to calculate the level of risk facing an organization based on the number of risk events that may occur within a time period and is often measured on an annual basis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

What are the factors that can affect likelihood?

A
  • volatility
  • velocity
  • proximity
  • interdependency
  • motivation
  • skill
  • visibility
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

What is the relation of volatility to risk?

A

Volatility=how much the situation varies. Varies greatly, harder to predict likelihood. Risk will be higher priority because of higher unpredictability (dynamic range)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

What is risk velocity?

A

Speed of onset. A measure of how much prior warning and preparation time an organization may have between the event’s occurrence and impact. Can be split into speed of reaction and speed of recovery.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

What is proximity?

A

The time from the even occurring and the impact on the organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

What is interdependency?

A

Consideration of risk in various combinations. Materialization of two or more risks and their impact on the organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

What is the relation of motivation to risk?

A

More motivated attacker = higher risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

What is the relation of skill to risk?

A

More skillful attacker = higher risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

What is visibility?

A

How well known a vulnerability is

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

What is risk impact?

A

The calculation of the amount of loss or damage that an organization may incur due to a risk event

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

How is loss measured?

A
  • quantitative
  • semi quantitative
  • qualitative
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

Risk management should be based on

A

Calculated actions and justified controls, not on emotion and perception

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

One method of calculating risk is evaluating the impact of the event on…

A

The confidentiality, integrity, and availability (CIA) of information or information systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

Risk associated with information system is primarily about

A

Business risk and the impact that the failure or compromise of a system or information would have on the overall business

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

The factors that affect the impact of an event may be measured in two ways:

A
  1. The impact due a compromise or loss of information

2. The impact due to the loss or compromise of an information system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

What will evaluate the impact of a breach according to a range of levels?

A

Qualitative risk assessment approach

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

What is confidentiality?

A

The requirement to maintain the secrecy and privacy of data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

What is a breach of confidentiality?

A

Improper disclosure of information to an unauthorized party

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

What are some factors that could lead to disclosure of data?

A
  • improperly managed access controls
  • social engineering
  • aggregation of data
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

What does need to know mean?

A

It means that individuals are given access only to information that is needed in order for them to perform their job functions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

What is least privilege?

A

Restriction of data access of an individual or process to only the minimum level of access needed to perform their functions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

What is integrity?

A

The guarding against improper information modification, exclusion, or destruction and includes ensuring information nonrepudiation and authenticity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

Maintaining integrity requires the protection of information from:

A

improper modification by internal authorized users, unauthorized users, or other processes or activities operating on the system

62
Q

How is the authenticity of information protected?

A

By identifying the sources of the data and ensuring that it has not been tampered with or destroyed

63
Q

What is authenticity?

A

Often called nonrepudiation. Ensures that a link can be made between an action and the source of the action

64
Q

What is availability?

A

Providing timely and reliable access to information

65
Q

How do you measure availability?

A

Using a gap analysis

66
Q

Where is the required level of availability usually found?

A

In the BIA (business impact analysis)

67
Q

What is Segregation of Duties?

A

The principle of ensuring that no one person controls an entire transaction or operation that could result to fraudulent acts or errors

68
Q

How do you circumvent SOD?

A

Through collusion, when two people agree to bypass the SOD control

69
Q

What is mutual exclusivity?

A

Means that a person cannot execute both parts of the same transaction

70
Q

What is job rotation?

A

The process of cross-training and developing personnel with various skills that can step up when needed

71
Q

What is secure state?

A

The principle that a transaction or process should be in and maintain a secure condition at all times as it goes through its various activities

72
Q

Access control is usually addressed through the following concepts:

A
  • identification
  • authentication
  • authorization
  • accountability
73
Q

How is identification performed?

A

Through checking of a user ID or other unique element that identifies a person or process

74
Q

What is authentication?

A

The process of validating an identity and ensures that one person cannot spoof an identity or masquerade as or impersonate another user

75
Q

What are the three methods of performing authentication?

A
  • knowledge
  • ownership
  • characteristics
76
Q

What is the risk in using knowledge (passwords)?

A

Passwords are often subject to replay attacks and can be learned by another user

77
Q

What is the problem with using ownership (possession) for authentication?

A

Cost of installing the system, issuing the cards, and operating and maintaining the system

78
Q

What is authorization?

A

The privileges or permissions the person will have in the system

79
Q

What is temporal isolation?

A

A person’s authorization that is only granted for a period of time that the permissions are required

80
Q

What is accountability/auditing?

A

This action logs or records all activity on a system and indicates the user ID responsible for the activity

81
Q

What is identity management?

A

The process of managing identities of the entities requiring access to information or information systems

82
Q

What is an asset?

A

Something of either tangible or intangible value that is worth protecting

83
Q

What is an asset value?

A

An asset may be valued according to what another person would pay for it, or by its measure of value to the company

84
Q

What is impact?

A

The magnitude of loss resulting from a threat exploiting a vulnerability

85
Q

What is impact analysis?

A

A study to prioritize the criticality of information resources for the enterprise based on costs (or consequences) of adverse events. In an impact analysis, threats to assets are identified and potential business losses determined for different time periods.

86
Q

What is impact assessment?

A

A review of the possible consequences of a risk

87
Q

What is likelihood?

A

The probability of something happening

88
Q

What is threat?

A

Anything that is capable of acting against an asset in a manner that can cause harm

89
Q

What is a threat agent?

A

Methods and things used to exploit a vulnerability

90
Q

What is a threat analysis?

A

An evaluation of the type, scope, and nature of events and actions that can result in adverse consequences; identification of threats against an enterprise

91
Q

What is a threat vector?

A

The path or route used by the adversary to gain access to the target

92
Q

What is a vulnerability?

A

A weakness in the design, implementation, operation, or internal control of a process that could expose the system to threats from threat events

93
Q

What is a vulnerability analysis?

A

Process of identifying and classifying vulnerabilities

94
Q

What is a vulnerability scanning?

A

An automated process to proactively identify security weaknesses in a network or individual system

95
Q

Risk is influenced more by

A

Lack of training than by lack of equipment

96
Q

The risk environment includes:

A
  • the context, criticality, and sensitivity of the system or process being reviewed
  • the dependencies and requirements of the system or process being reviewed
  • The operational procedures, configuration, and monitoring of the system or business process
  • The training of users and administrators
  • the effectiveness of the controls and monitoring of the system or business process
  • the manner in which data and system components are decommissioned
97
Q

Risk only occurs if

A

The adversary has intent (motivation) and capability

98
Q

To implement a justifiable risk strategy, start with

A

Identifying the organization’s assets and determining the value of those assets

99
Q

When calculating asset value, one technique is to base it on

A

Impact of a loss of CIA

100
Q

What are contributing factors to calculating asset value?

A
  • financial penalties for legal noncompliance
  • impact on business processes
  • damage to reputation
  • additional costs of repair/replacement
  • effect on third parties/ business partners
  • injury to staff or other personnel
  • violations of privacy
  • breach of contracts
  • loss of competitive advantage
  • legal costs
101
Q

Threats can be…

A

Intentional or unintentional

External or internal

102
Q

Categories of threats

A 
Physical
Natural events
Loss of essential services
Disturbance due to radiation
Compromise of information
Technical failures
Unauthorized actions
Compromise of functions
103
Q

What are sources of information on threats?

A 
Service providers 
threat monitoring agencies
Security companies
Audits
Management
Business continuity
Finance
Insurance companies
Product vendors
Government publications
Assessments
Users
Human resources
Media
104
Q

The trusted or malicious insider threat to an organization can be…

A

A current or former employee
Contractor
Business partner
Who has or had authorized access to an organization’s system, network, or data and intentionally infiltrated, interrupted, modified, or fabricated data on an organization’s information system

105
Q

Samples of external threats

A 
Espionage
Theft
Sabotage
Terrorism
Criminal acts
Software errors
Hardware flaws
Mechanical failures
Lost assets
Data corruption
Facility flaws
Supply chain interruption
Industrial accidents
Disease
Seismic activity
Flooding
Power surge / utility failure
Severe storms
106
Q

What are indications of emerging threats?

A

Unusual activity on a system, repeated alarms, slow system or network performance, new or excessive activity in logs

107
Q

Why are new technologies a new threat source?

A

Because most technologies are built with an emphasis on function and purpose without due consideration for the security implications associated with the new technology

108
Q

What are network vulnerabilities?

A

Related to misconfiguration of equipment, poor architecture, or traffic interception

(network equipment should be hardened to disable unneeded services, ports, or protocols)

109
Q

Testing for physical security vulnerabilities include testing

A 
Locks
Security guards
Fire suppression systems
Heating ventilation
Air conditioning controls
Lighting
Cameras
Motion sensors
110
Q

What are common application vulnerabilities?

A 
Buffer overflows
Logic flaws
Injection attacks
Bugs
Incorrect control over user access
111
Q

OWASP

A

Open Web Application Security Project

112
Q

What are the different cloud deployment models?

A

Private
Public
Hybrid
Community

113
Q

Characteristics of a private cloud

A

Operated solely for an enterprise
May be managed by the enterprise or a third party
May exist on or off premise

114
Q

Characteristics of a public cloud

A

Made available to the general public or a large industry group
Owned by an organization selling cloud services

115
Q

Characteristics of a community cloud

A

Shared by several enterprises
Supports a specific community that has a shared mission or interest
May be managed by the enterprises or a third party
May reside on or off premise

116
Q

Characteristics of a hybrid cloud

A

A composition of two or more clouds that remain unique entities but are bound together by a standardized or proprietary technology that enables data and application portability

117
Q

When outsourcing data processing

A

It does not remove the liability of the outsourcing organization to ensure data are properly protected and the transmission of data is compliant with laws on data transfer

118
Q

What is a vulnerability assessment?

A

Careful examination of a target environment to discover any potential points of compromise and weakness

119
Q

Samples of vulnerabilities

A 
Network vulnerabilities
Poor physical access controls
Insecure applications
Poorly designed or implemented web facing services
Disruption to utilities
Unreliable supply chain
Untrained personnel
Inefficient processes
Poorly maintained or old equipment
120
Q

What is penetration testing?

A

A targeted testing against a potential vulnerability or against an attack vector commonly used by an attacker that simulates the activities and approach used by an attacker

121
Q

What is full knowledge testing?

A

The testing team is familiar with the entire infrastructure being tested

122
Q

What is zero knowledge testing?

A

The testing team is in the position of the external hacker

123
Q

What is the risk associated with intellectual property?

A

Failure to protect IP from improper use, disclosure, or duplication that may result in loss of IP for a product

124
Q

What is risk scenario?

A

A description of a possible event that, when occurring, will have an uncertain impact on the achievement of the enterprise’s objectives. The impact can be positive or negative.

125
Q

The development of risk scenarios is based on…

A

Describing a potential risk event and documenting the factors and areas that may be affected by the risk event

126
Q

Risk events may include…

A 
System failure
Loss of key personnel
Theft
Network outages
Power failures
Natural disasters
127
Q

The key to developing effective scenarios is…

A

To focus on real and relevant potential risk events

128
Q

Ways a risk scenario can be developed

A

Top down

Bottom up

129
Q

Top down approach starts with

A

Business goals to come up with risk scenarios

Based on understanding business goals and how a risk event could affect the achievement of those goals

130
Q

Bottom up approach starts with

A

Generic risk scenarios to more specific risk scenarios

Based on describing risk events that are specific to individual enterprise situations

131
Q

What is a risk scenario?

A

A description of an IT related risk event that can lead to a business impact

132
Q

Components of a risk scenario

A

Actor: internal or external party that generates the threat
Threat type: nature of the threat event
Event: the security incident
Asset: the entity affected by the risk event
Time: if relevant to the scenario (i.e. Duration, timing, detection, time lag between event and the consequence)

133
Q

A risk awareness program creates…

A

An understanding of risk, risk factors, and the various types of risk that an organization faces

134
Q

A risk awareness program should not…

A

Disclose vulnerabilities or ongoing investigations except when the problem has been addressed

135
Q

An awareness program for management should highlight…

A

The need for management to play a supervisory role in protecting systems and applications from attack

136
Q

Awareness training for senior management should highlight…

A

The liability, need for compliance, due care and due diligence, and the need to create the tone and culture of the organization through policy and good practice

137
Q

Criteria for risk acceptance

A

Consideration of the availability of mitigating controls
The needs of regulation
Cost benefit analysis of a control option
The risk versus reward incentive that management is willing to consider

138
Q

What is residual risk?

A

Risk that remains after the implementation of risk treatment controls

139
Q

What is risk tolerance?

A

Acceptable variation that management is willing to allow for any particular risk as the enterprise pursues its objectives

140
Q

Ownership of risk is ultimately the responsibility of…

A

The asset owners, or in most cases, senior management

141
Q

Risk acceptance must not exceed the…

A

Risk capacity of the organization

142
Q

What is risk capacity?

A

The objective amount of loss an enterprise can tolerate without risking its continued existence

143
Q

Risk capacity and risk appetite are defined by

A

The board and executive management at the enterprise level

144
Q

What are risk tolerance levels?

A

Tolerable deviations from the level set by the risk appetite definitions

145
Q

The risk register shows the…

A

Severity, source, and potential impact of a risk

Identifying the risk owner and the current status and disposition of risk

146
Q

The purpose of a risk register is…

A

To consolidate risk data into one place and permit the tracking of risk
Contains all the risk identified in audits, vulnerability assessments, penetration tests, incident reports, process reviews, management inputs, risk scenario creation, and security assessments

147
Q

The owner of the risk also owns the…

A

Controls and is responsible for monitoring its effectiveness

148
Q

What is a control?

A

It is a means of managing risk, including policies, procedures, guidelines, practices or organizational structures

149
Q

Developing a manageable and relevant set of risk scenarios requires:

A

Expertise and experience
A thorough understanding of the environment
The intervention and common views of all parties involved
A brainstorming/ workshop approach

150
Q

What is systemic risk?

A

Something happens with an important business partner, affecting a large number of enterprises within an area or industry

151
Q

What is contagious risk?

A

Events that happen at several of the enterprise’s business partners within a very short time frame

Secret (4 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions