Chapter 4 Review Flashcards
Chapter 4 Review
An information security program comprises all the activities used to perform these 2 tasks in regards to risks
IDENTIFY and TREAT
At tactical and strategic levels, all activities in a program fulfill this purpose.
Chapter 4 Review
A security program is outcomes based; when a strategy is developed, the objectives of the strategy are intended to achieve this thing.
DESIRED END STATES or OUTCOMES
After management has determined the desired outcomes of the information security program, development of a strategy can begin, together with initiating the process of developing information security governance structures, achieving organizational adoption and developing an implementation strategy that will define the scope and responsibilities of the security program
Chapter 4 Review
These 2 activities are carried out in the security program bring the organization closer to desired states and outcomes.
TASKS and PROJECTS
Chapter 4 Review
This activity in risk management is a process whereby the organization chooses how to handle an identified risk.
RISK TREATMENT
Chapter 4 Review
The four risk treatment choices are;
- ACCEPT
- MITIGATE
- TRANSFER
- AVOID
Chapter 4 Review
What decisions should be made by the affected line-of business owners, executive management, and steering committee
RISK TREATMENT DECISIONS
Chapter 4 Review
After risk treatment, the leftover risk is known as this
RESIDUAL RISK
Chapter 4 Review
This type of risk should be processed through the risk management process as though it were a new risk.
RESIDUAL RISK
Chapter 4 Review
During risk treatment, the organization needs to consider these 2 areas of issues to ensure that risk treatment decisions and methods of risk mitigation do not themselves create compliance risk
LEGAL and REGULATORY
Chapter 4 Review
The costs and benefits of risk treatment should also be considered. Although, as the adage goes, it doesn’t make sense to spend $20,000 to protect a $10,000 asset, the value and role of an asset need to be considered. As the adage continues, it may be a $10,000 asset, but it may also be a critical component in the earning of $1 million in revenue every month.
Chapter 4 Review
This is the level of risk that an organization is willing to accept while in the pursuit of its mission, strategy, and objectives.
RISK APPETITE
Chapter 4 Review
Risk treament and risk acceptance decisions should be assigned to and made by these 2 groups of people within the organisation who are accountable for those decisions.
BUSINESS OWNERS and EXECUTIVES
Chapter 4 Review
This person facilitates and communicates risk treatment and ownership responsibilities; only in specific instances will they own a risk item
CISO
Chapter 4 Review
Risk monitoring is the set of ongoing activities to detect this
CHANGES IN RISK
Chapter 4 Review
Typical risk monitoring activities include these 4 assessments or audits;
- R____ ; Evaluate a risk
- V____ ; Evaluate a weakness
- I____ A ____ ; Carried out by employees of the organisation
- C____ S ____ ; Conducted by owners of he countermeasures
- RISK ASSESSMENTS
- VULNERABILITY ASSESSMENTS
- INTERNAL AUDITS
- CONTROL SELF ASSESSMENTS
