Chapter 2 - Personnel Security And Risk Management Concepts Flashcards
Define Personally Identifiable Information (PII)
PII is any data item that can be easily and/or obviously tracked back to the person of origin or concern. For example, a phone number, email address, mailing address, social security number, and name are all PII.
Calculating Safeguard Cost/Benefit Formula
Pre-countermeasure ALE - post-countermeasure ALE - ACS (annual cost of safeguard)
The importance of Job Descriptions
Job descriptions are important to the design and support of a security solution.
Documentation Review
Documentation review is the process of reading exchanged materials and verifying them against standards and expectations. The documentation review is typically performed before any on-site inspection takes place. If the exchanged documentation is sufficient and meets expectations, then an on-site review will be able to focus on compliance with the stated documentation. However, if the documentation is incomplete, inaccurate, or otherwise insufficient, the on-site review is postponed until the documentation can be updated and corrected. This step is important because if the documentation is not in compliance, chances are the location will not be in compliance either.
Threat Events
Threat events are accidental and intentional exploitations of vulnerabilities. They can also be natural or man made. Threat events include fire, earthquake, flood, system failure, human error, and power outage.
When a safeguard or a countermeasure is not present or is not sufficient, what remain?
Vulnerability. A vulnerability is the absence or weakness of a safeguard or countermeasure.
When evaluating safeguards, what is the rule that should be followed in most cases?
The annual costs of safeguards should not exceed the expected annual cost of asset loss.
To make the determination of whether the safeguard is financially equitable, what the formula should be used?
ALE before safeguard - ALE after implementing the safeguard - annual cost of safeguard (ACS) = value of the safeguard to the company
Security Training
Training is teaching employees to perform their work tasks and to comply with the security policy. Training is typically hosted by an organization and is targeted to groups of employees with similar job functions.
Components of managing the security function
Assessment of budgets, metrics, resources, information security strategies, and assessing the completeness and effectiveness of the security program.
Effects of countermeasure
A countermeasure directly affects the annualized rate of occurrence, primarily because the countermeasure is designed to prevent the occurrence of the risks, thus reducing its frequency per year.
Which answer is the term used to describe the processes used to plan, allocate and control information security resources?
ESA Framework is the processes used to plan, allocate and control information security resources.
Whichever architecture you implement, the purpose is to support the business goals of the organization through the us of effective security investment.
Some metrics used to determine if you are successful are:
- Strategic alignment
- Effective risk management
- Resource Management
- Performance measurement
How financial risks can be calculated is by using the formula?
The correct answer is: P * M = C
Financial risks can be quantified in many cases and are generally used to help determine how much should be spent on the recovery program. One of the ways financial risk can be calculated is using the formula P * M = C
Probability of harm (P) : the chance that a damaging event will occur
Magnitude or Harm (M): the amount of financial damage that would occur should a disaster happen
Cost of the prevention (C): the price of putting in place a countermeasure preventing the disaster’s effects. The cost of countermeasures should not be more than the cost of the event
A tip to use to remember this is: “A Project Manager (PM) cries many times when he thinks of the cost “ (P * M = C)
Risk Avoidance
When we deploy publically accessible information systems there is a level of risk we must be willing to accept simply to operate the system.
If we need not host a service that is not necessary to business functions then it is a risk to be avoided. All In other words, don’t host a service (Like a web server, mail server or any other software system accessible by the public) if it is no absolutely necessary to the business model.
By NOT hosting the service we are avoiding the risk altogether.
Risk Assessment
The risk assessment is critical because it enables the person responsible for contingency planning to focus risk management efforts and resources in a prioritized manner only on the identified risks. The risk management process includes the risk assessment and determination of suitable technical, management, and operational security controls based on the level of threat the risk imposes. Business units should be included in this process.
