Chapter 2 (Domain 1) Flashcards
Personnel Security and Risk Management Concepts
IAM
Identity and Access Management
System of an organization which will provision the account and assign necessary privileges and access.
AUP
Acceptable Use Policy
Policy that users must understand and sign to adhere to the necessary policies related to their perspective job position.
Asset
Anything used in a business process or task. Person, place, or thing.
Asset Valuation
Value assigned to an asset based on a number of factors.
Threats
Any potential occurrence that may cause and undesirable or unwanted outcome for an organization or for a specific asset.
Threat Agent/Actors
Intentionally exploit vulnerabilities. Usually people but can be programs, hardware, or systems.
Threat Events
Accidental occurrence or intentional exploitations of vulnerabilities.
Threat Vector
AKA Attack Vector. The path or means by which an attack or attacker can gain access to a target in order to cause harm.
Vulnerability
The weakness in an asset or the absence or the weakness of a safeguard or countermeasure is a vulnerability.
Exposure
Being susceptible to asset loss because of a threat
Risk
The possibility or likelihood that a threat will exploit a vulnerability to cause harm to an asset and the severity of damage that could result.
Risk = Threat * Vulnerability
Risk = Probability of harm * Severity of harm
Safeguards
Security control, protection mechanism, or countermeasure that removes/reduces the vulnerability or protects against one or more specific threats.
Attack
An attack is the intentional attempted exploitation of a vulnerability by a threat agent to cause damage, loss, or disclosure of assets.
Breach
Breach, intrusion, or penetration is the occurrence of a security mechanism being bypassed or thwarted by a threat agent.
Delphi Technique
An anonymous feedback-and-response process used to enable a group to reach an anonymous consensus.
Single-loss Expectancy (SLE)
SLE = Asset Value (AV) * Exposure Factor (EF)
Annual Loss Expectancy (ALE)
ALE = ARO * SLE ALE = ARO * AV * EF
Risk Mitigation
The implementation of safeguards, security controls, and countermeasures to reduce and/or eliminate vulnerabilities or block threats.
Risk Assignment
Assignment/Transferring is the placement of the responsibility of loss due to a risk onto another entity or organization. ie… insurance
Risk Deterrence
Process of implementing deterrents to would-be violators of security and policy.
Risk Avoidance
Is the process of selecting alternate options or activities that have less associated risk than the default, common, expedient, or cheap option.
Risk Acceptance
The result after a cost/benefit analysis shows countermeasure costs would outweigh the possible cost of loss due wot a risk.
Risk Rejection
Ignoring the risk.
Inherent risk
The level of natural, native , or default risk that exists in an environment, system, or product prior to any risk management efforts being performed.
