Chapter 7 - Risk, Response and Recovery Flashcards
What is a Risk?
A Risk is the likelihood that a threat will exploit a vulnerability that could lead to a loss.
What is a Threat?
A Threat is any activity that can be a possible danger.
A threat can be adversarial, political, environmental etc.
What is a Vulnerability?
A Vulnerability is any weakness in a system/organization.
What is a Loss?
A loss is any event that represents a negative impact for an organization.
What is the Risk, Threat and Vulnerability formula?
Risk = Threat x Vulnerability
What is a Threat Event?
A Threat Event occurs through a threat source.
A TA launches a SQL injection attack.
Threat Source = Threat Actor
Threat Event = SQL injection attack
Vulnerability = Server was susceptible to SQL injection attack
Loss = Data loss, fines etc.
What are the different threat sources?
- Adversarial Threat Source:
- Active threat actors, internal or external to an organization - Accidental Threat Source:
- Accidents in a workplace such as a user accidentally deleting a database - Structural Threat Source:
- IT equipment failures or building failures - Environmental Threat Source:
- Natural disasters such as earthquakes, typhoons etc.
What are the 7 stages of the Cyber Kill Chain?
- Reconnaissance
- Weaponization
- Delivery
- Exploitation
- Installation
- Command and Control
- Action on Objectives
What are the different ways risks are treated by organizations?
Mitigate:
- Reducing vulnerabilities through the use of controls and safeguards
Avoid:
- Simply avoiding the risk by avoiding the risk activity
Share or Transfer:
- Paying for services such as insurances
Accept:
- An organization can accept a risk typically when cost of asset is less than cost of mitigating the risk
Recast:
- Risk management is constantly evolving and risks must always be reconsidered and recategorized.
What is Residual Risk?
Residual Risk is the amount of risk that remains post risk mitigation and countermeasures have been put in place.
Residual Risk needs to be at an acceptable level for the organization.
What is a Risk Register?
A Risk Register is central depository for known risks to an organization.
Also known as a Risk Log, this will also contain the deployed countermeasures in relation to each of the identified risks.
A Risk Score is also associated with each entry to the Risk Register
Risk Score = Probability x Impact
What is the Risk Score formula?
Risk Score = Probability x Impact
What is a Common Vulnerability Scoring System (CVSS)?
The CVSS is the open standard that organizations use to assess the severity of security system vulnerabilities.
Vulnerabilities are scored between 0 - 10 with 10 being the most severed.
Scores are based on several metrics, these are categorized as Base and Impact metrics.
What are the CVSS Base Metrics?
Access Vector:
- How might the vulnerability be exploited
Access Complexity:
- How much technical knowledge is required to exploit the discovered vulnerability
Authentication:
- The number of times the threat actor must authenticate to exploit the vulnerability.
What are the CVSS Impact Metrics?
The impact metrics are all of the CIA triad.
