Chapter 2 Personnel Security and Risk Management Concepts

Question 1

________ is the collection of practices related to supporting, defining, and
directing the security efforts of an organization.

Answer 1

Security governance

Question 2

Any potential occurrence that may cause an undesirable or unwanted outcome
for an organization or for a specific asset

Threats
Vulnerability
Exposure
Risk
Attack
Breach

Answer 2

Threats

Question 3

The weakness in an asset or the absence or the weakness of a safeguard or
countermeasure

Threats
Vulnerability
Exposure
Risk
Attack
Breach

Answer 3

Vulnerability

Question 4

being susceptible to asset loss

Threats
Vulnerability
Exposure
Risk
Attack
Breach

Answer 4

Exposure

Question 5

possibility or likelihood that a threat will exploit a vulnerability to cause
harm to an asset

Threats
Vulnerability
Exposure
Risk
Attack
Breach

Answer 5

Risk

Question 6

any intentional attempt to exploit a vulnerability of an organization’s security
infrastructure to cause damage, loss, or disclosure of assets.

Threats
Vulnerability
Exposure
Risk
Attack
Breach

Answer 6

Attack

Question 7

the occurrence of a security mechanism being bypassed or thwarted by a threat agent.

Threats
Vulnerability
Exposure
Risk
Attack
Breach
penetration

Answer 7

Breach

Question 8

the percentage of loss that an organization would experience if a specific asset were violated by a realized risk.

Exposure Factor
Single Loss Expectancy
Annualized Rate of Occurrence
Annualized Loss Expectancy

Answer 8

Exposure Factor

Question 9

the cost associated with a single realized risk against a specifi c asset. It indicates
the exact amount of loss an organization would experience if an asset were harmed by a
specific threat occurring.

Exposure Factor
Single Loss Expectancy
Annualized Rate of Occurrence
Annualized Loss Expectancy

Answer 9

Single Loss Expectancy

Question 10

the expected
frequency with which a specifi c threat or risk will occur (that is, become realized) within
a single year.

Exposure Factor
Single Loss Expectancy
Annualized Rate of Occurrence
Annualized Loss Expectancy

Answer 10

Annualized Rate of Occurrence

Question 11

the possible yearly
cost of all instances of a specific realized threat against a specific asset.

Exposure Factor
Single Loss Expectancy
Annualized Rate of Occurrence
Annualized Loss Expectancy

Answer 11

Annualized Loss Expectancy

Question 12

Security controls, countermeasures, and safeguards can be implemented ______, _______ and __________ .

Answer 12

administratively,

logically/technically, or physically

Question 13

AV * EF =

ARO
SLE
ALE

Answer 13

SLE

Question 14

SLE * ARO =

ARO
SLE
ALE

Answer 14

ALE

Question 15

threats * vulnerabilities * asset value =

Answer 15

total risk

Question 16

total risk – controls gap =

Answer 16

residual risk

Question 17

In which step of the RMF does information system operation based on a determination of the risk to
organizational operations and assets, individuals, other organizations, and the Nation
resulting from the operation of the information system and the decision that this risk
is acceptable.

Answer 17

Authorize

Question 18

In which step of the RMF is the security controls and describe how the controls are employed within
the information system and its environment of operation.

Answer 18

Implement

Question 19

In which step of the RMF does the information system and the information processed, stored, and transmitted by that system based on an impact analysis.

Answer 19

Categorize

Question 20

In which step of the RMF does the security controls in the information system on an ongoing basis including assessing control effectiveness, documenting changes to the system or its environment of operation, conducting security impact analyses of the associated changes, and reporting the security state of the system to designated organizational officials.”

Answer 20

Monitor

Question 21

In which step of the RMF does information system operation based on a determination of the risk to
organizational operations and assets, individuals, other organizations, and the Nation resulting from the operation of the information system and the decision that this risk is acceptable.

Answer 21

Authorize

Question 22

In which step of the RMF does an initial set of baseline security controls for the information system based on the security categorization; tailoring and supplementing the security control baseline
as needed based on an organizational assessment of risk and local conditions.

Answer 22

Select

Question 23

The six major elements of quantitative risk analysis

Answer 23

1. Inventory assets, and assign a value (asset value, or AV). (Asset value is detailed further in a later section of this chapter named “Asset Valuation.”)
2. Research each asset, and produce a list of all possible threats of each individual asset. For each listed threat, calculate the exposure factor (EF) and single loss expectancy (SLE).
3. Perform a threat analysis to calculate the likelihood of each threat being realized
   within a single year—that is, the annualized rate of occurrence (ARO).
4. Derive the overall loss potential per threat by calculating the annualized loss expectancy (ALE).
5. Research countermeasures for each threat, and then calculate the changes to ARO and ALE based on an applied countermeasure.
6. Perform a cost/benefit analysis of each countermeasure for each threat for each asset. Select the most appropriate response to each threat.

Question 24

Calculating Safeguard Cost/Benefit

Answer 24

ALE before safeguard – ALE after implementing the safeguard – annual cost of safeguard (ACS) = value of the safeguard to the company

Question 25

Which step of the RMF is described below:

“information system operation based on a determination of the risk
to organizational operations and assets, individuals, other organizations, and
the Nation resulting from the operation of the information system and the
decision that this risk is acceptable.”

Categorize
Select
Implement
Assess
Authorize
Monitor

Answer 25

Authorize

Question 26

Which step of the RMF is described below:

” the security controls using appropriate assessment procedures to
determine the extent to which the controls are implemented correctly,
operating as intended, and producing the desired outcome with respect to
meeting the security requirements for the system.”

Categorize
Select
Implement
Assess
Authorize
Monitor

Answer 26

Assess

Question 27

Which step of the RMF is described below:

“the information system and the information processed, stored, and transmitted by that system based on an impact analysis.”

Categorize
Select
Implement
Assess
Authorize
Monitor

Answer 27

Categorize

Question 28

Which step of the RMF is described below:

“the security controls and describe how the controls are employed within the information system and its environment of operation.”

Categorize
Select
Implement
Assess
Authorize
Monitor

Answer 28

Implement

Question 29

Which step of the RMF is described below:

“an initial set of baseline security controls for the information system based on
the security categorization; tailoring and supplementing the security control baseline
as needed based on an organizational assessment of risk and local conditions.”

Categorize
Select
Implement
Assess
Authorize
Monitor

Answer 29

Select

Question 30

Which step of the RMF is described below:

“the security controls in the information system on an ongoing basis including assessing control effectiveness, documenting changes to the
system or its environment of operation, conducting security impact analyses
of the associated changes, and reporting the security state of the system to
designated organizational officials.”

Categorize
Select
Implement
Assess
Authorize
Monitor

Answer 30

Monitor

Question 31

_______ is a more detailed endeavor in which students/users learn much more than they actually need to know to perform their work tasks.

Awareness
Training
Education

Answer 31

Education

Question 32

__________ establishes
a common baseline or foundation of security understanding across the entire organization and focuses on key or basic topics and issues related to security that all employees must understand and comprehend.

Awareness
Training
Education

Answer 32

Awareness

Question 33

_______ is teaching employees to perform their work tasks and to comply with the security policy.

Awareness
Training
Education

Answer 33

Training