Chapter 2: IT Risk Assessment Flashcards
How does risk identification begin?
By documenting the assets of the organization and determining the value of an asset
Risk identification also includes…
Documenting threats that could pose a risk of damage to the organization
What is risk assessment?
A process used to identify and evaluate risk and its potential effects
Statistical inference that uses prior distribution data to determine the probability of a result
Bayesian Analysis
Provides a diagram to communicate risk assessment results by displaying links between possible causes, controls, and consequences. The cause of the event is depicted in the middle of the diagram and triggers, controls, mitigation strategies, and consequences branch off the knot.
Bow Tie Analysis
The purpose of this is to gather a large group of types of potential risk or ideas
Brainstorming/ Structured Interview
The process to determine the impact of losing the support of any resource
Business Impact Analysis
Combines the technique of a fault tree analysis and and even tree analysis and allows for time delays to be considered
Cause and Consequence Analysis
Looks at the factors that contributed to a certain effect and groups the causes into categories which are then displayed using a diagram
Cause-and-effect Analysis
List of potential or typical threats or other considerations that should be of interest to the organization
Checklists
Uses expert opinion which is often received using two or more rounds of questionnaires
Delphi Method
A forward, bottom up model that uses inductive reasoning to assess the probability of different events resulting in possible outcomes
Event Tree Analysis
Starts with an event and examines possible means for the event to occur and displays these results in a logical tree diagram
Fault Tree Analysis
Originally developed for the food safety industry for proactively preventing risk and assuring quality, reliability, and safety of processes
Hazard Analysis and Critical Control Points (HACCP)
A structured means of identifying and evaluating potential risk by looking at possible deviations from existing processes
Hazard and Operability Studies (HAZOP)
Examines the effect of human error on systems and their performance
Human Reliability Analysis (HRA)
A semiquantitative risk analysis technique that uses aspects of HAZOP data to determine risk associated with risk events. Also looks at controls and their effectiveness.
Layers of Protection Analysis (LOPA)
Used to analyze systems that can exist in multiple states and assumes that future events are independent of past events
Markov Analysis
A simulation used to establish the aggregate variation in a system resulting from variations in the system, for a number of inputs, where each input has a defined distribution and the inputs are related to the output via defined relationships
Monte Carlo Analysis
Looks at what threats or hazards may harm an organization’s activities, facilities, or systems
Preliminary Hazard Analysis
Analyzes the functions and potential failures of a specific asset, particularly a physical asset such as equipment
Reliability-centered Maintenance
Examines possible future scenarios that were identified during risk identification
Scenario Analysis
Used to identidy design errors or sneak conditions- latent hardware, software, or integrated conditions that may cause an unwanted event to occur
Sneak Circuit Analysis
Uses structured brainstorming to identify risk, typically within a facilitated workshop
Structured “What If” Analysis
What are contributing factors in risk prevention, detection, and response?
Structure and culture of the organization
The risk management function should have an enterprise wide mandate that
Allows the risk management team to review and provide input into all business processes
The risk management function should participate in…
Incident management activities and be responsible for investigating incidents to ensure that all lessons are learned
Policies provide direction regarding…
Acceptable and unacceptable behavior and actions to the organization and send a clear message from senior management regarding the desired approach to the protection of assets and the culture of the organization
Policies give authority to the…
Staff of risk management, audit, and security teams of the organization to perform their job responsibilities
High level is policy is issued by
Senior management as a way to address the objectives of the organization’s mission and vision statement
High level policy (aka overarching security policy) should require compliance with…
Laws and best practices, and state the goal of managing risk through protecting the organization’s assets
The next level of policies after the high level policy is…
Technical and functional
Where policies are out of date, unenforced, or incomplete, the risk practitioner should…
Underline the vulnerability and the risk it poses to the organization
A mandatory requirement, code of practice, or specification approved by external standards organizations
Standard
A document containing a detailed description of the steps necessary to perform specific operations in conformance with applicable standards
Procedures
A lack of standards and procedures will result in…
Undependable, inconsistent operations and may result in risk due to not detecting a risk event, noncompliance, or difficulty preventing an attack
What is risk identification?
The process of determining and documenting risk that an enterprise faces.
Some of the considerations that affect risk assessment related to technology:
Age of equipment Expertise available for maintenance Variety of vendors/suppliers Documentation of systems Availability of replacement parts Ability to test systems or equipment Operating environment and user expertise Ability to patch/mitigate vulnerabilities
A key factor in the maturation of the processes and practices of an organization is the development of…
An enterprisewide approach to risk management, architecture, and business continuity
A lack of architecture often results in:
Controls that overlap Controls that conflict with one another Unidentified single points of failure Unidentified methods to bypass controls Inadequate network isolation
Controls are implemented to…
Mitigate risk or comply with regulations
An alternate form of control that corrects a deficiency or weakness in the control structure of the enterprise; may be considered when an entity cannot meet a requirement explicitly, as stated, due to legitimate technical or business constraints, but has sufficiently mitigated the risk associated with the requirement through implementation of other controls
Compensating controls
Remediate errors, omissions, and unauthorized uses and intrusions, once they are detected
Corrective controls
Warn of violations or attempted violations of security policy and include such controls as audit trails, intrusion detection methods, and checksums
Detective controls
Provide warnings that can deter potential compromise, such as warning banners on login screens or offering rewards for the arrest of hackers
Deterrent controls
Mandate the behavior of an entity by specifying what actions are, or are not, permitted
Directive control
Inhibit attempts violate security and include such controls as access control enforcement, encryption, and authentication
Preventive controls
The risk is much more serious if:
Controls are inadequate. The wrong controls are being used. Controls are ignored or bypassed. Controls are poorly maintained. Logs or control data are not reviewed. Controls are not tested. Changes to configuration of controls are not managed. Controls can be physically accessed and altered.
The condition of the program at a point in time
Current state
Used to determine the state of IT risk on a regular basis and with scheduled reporting to management
Regular reviews of IT risk
An excellent source of analysis data and recommendations which are often related to the improvement of managerial, technical, and operational controls
Audits
The risk practitioner must test the performance of the control to ensure that it is…
It is properly installed, operating correctly, and providing the desired result
Testing the control includes…
Testing both the technical and nontechnical aspects of the control
What are the nontechnical aspects of a control?
Rules governing the operation of the control
Procedures used in monitoring and operating the control
Proficiency if the staff responsible for the operation of the control
A thorough review of an incident can identify…
Weak controls
Poor detection
Inappropriate or ineffective response
Lack of training of staff
Interviewing operations staff and reviewing logs and trouble tickets may…
Indicate an unmitigated or recurring problem or trend within a system that may require remediation
Logs should contain a record of all important events that occur on a system such as…
Changes to permissions System start up or shut down Login or logout Changes to data Errors or violations Job failures
A review of logs can identify…
Risk relevant events and can detect compliance violations, suspicious behaviors, errors, probes or scans, and abnormal activity
It is a careful, methodical review of the security controls for a system with the intent of discovering any weaknesses or potential gaps on the control framework that could allow a successful attack
Vulnerability assessment
Techniques for vulnerability assessments:
Social engineering
Physical security tests
Network probes and scans
Application vulnerability reviews
Possible vulnerabilities
Unpatched systems
Buffer overflows
Susceptibility to injection attacks
Unlocked server rooms
Exposed cabling
Sensitive data left on unattended desks or screens
Open ports or services that are not required
Can be used to validate the results of a vulnerability assessment and prove whether the controls and countermeasures used by the organization are working correctly
Penetration test
The desired state of IT risk is closely linked to the the
Risk acceptance level set by management
Challenges of data analysis
Are all of the data available?
Have any of the data been altered or changed?
Are the data in the correct format?
Are the data based on measuring important factors?
A predictive or diagnostic analytical tool that is used to explore the root causes or factors that contribute to positive or negative effects or outcomes and to identify potential risk
Cause and effect analysis
A technique that provides a systematic description of the combination of possible occurrences in a system, which can result in an undesirable outcome (top-level event) and combines hardware failures and human failure
Fault tree analysis
A quantitative risk analysis technique that helps to determine which risk factors potentially have the most impact and examines the extent to which the uncertainty of each element affects the object under consideration when all other elements are held at their baseline values
Sensitivity analysis
Examines the nature of the threat and the potential threat scenarios
Threat modeling
It is done by mapping the potential method, approaches, steps, and techniques used by an adversary to perpetrate an attack
Threat modeling
Examines how a system will function and provide “use” for users
Use case modeling
Looks at all possible errors, mistakes, or ways a system can be misused
Misuse case modeling
Examines ways a system can be attacked and used for a purpose for which the system was never intended
Threat modeling
A process of diagnosis to establish the origins of events which can be used for learning from consequences, typically from errors and problems
Root cause analysis
A facilitated workshop where the group is told to pretend that the project has failed and then they are to discuss why it has failed
Pre-mortem
Base on documenting the desire state or condition of risk that management wants to reach and then carefully analyzing and evaluating the current condition of the organization; identifies the current gap or difference between the desired and current state so that corrective action can be taken when necessary
Gap analysis
It is a measure that determines how well the process is performing in enabling the goal to be reached; it is a good indicator of capabilities, practices, and skills
KPI Key Performance Indicator
A good method of indicating a trend that may have the potential to result in a problem in the future
Key Risk Indicator KRI
A measure that tells management, after the fact, whether an IT process has achieved its business requirements and is usually expressed in terms of information criteria
Key Goal Indicator KGI
Two main methods of analyzing risk
Quantitative and Qualitative
Based on numerical calculations, such as monetary values, and is most suitable for supporting cost-benefit analysis calculations because all IT risk can be compared to the cost of a control and the value of the benefit that the control would provide
Quantitative risk assessment
Quantitative risk assessment is often based on the…
Calculation of the impact of a single risk event and on what the event would cost, including direct costs (lost of sales) and indirect costs (damage to reputation)
