Chapter 8 Using Risk Management Tools Flashcards
___ is the likelihood that a threat will exploit a vulnerability
Risk
A _____ is a weakness
Vulnerability
A ____ is a potential danger
Threat
____ refers to the magnitude of harm that can be caused if a threat exercises a vulnerability
Impact
A system without up-to-date antivirus software is vulnerable to ______
Malware
Malware written by malicious attackers is the ______
Threat
The likelihood that the malware will reach a vulnerable system represents the ____
Risk
Within the context of risk management, a ____ is any circumstance or event that can compromise the confidentiality, integrity, or availability of data or a system
Threat
List different forms of threats
Malicious human threats - script kiddies, apts, network, system, malware attacks
Accidental human threats - accidentally delete or corrupt data, or accidentally access data they shouldn’t. Unintentionally cause outages.
Environmental threats - Power failure, mother nature
A _____ ____ helps an organization identify and categorize threats.
Threat assessment
Organizations have limited ____ so it’s not possible to protect against all threats.
Resources
List some common types of threat assessments
Environmental - evaluates the likelihood of an environmental threat occurring.
Manmade - evaluates all threats from humans
Internal - evaluates threats from within an organization. Threats from malicious employees and accidents
External - evaluates threats from outside an organization. External attackers and natural threats
A ___ is a flaw or a weakness in software or hardware, or a weakness in a process that a threat could exploit, resulting in a security breach.
Vulnerability
List some examples of vulnerabilities
Lack of updates - not up to date on patches, hotfixes, and service packs
Default configurations - hardening includes changing systems from their default hw and sw configurations, including changing default usernames and passwords
Lack of malware protection or updated definitions
Lack of firewalls
Lack of organizational policies
___ _____ is the practice of identifying, monitoring, and limiting risks to a manageable level.
Risk management
True or False Risk management eliminates risks
False. It identifies methods to limit or mitigate them.
The amount of risk that remains after managing risk is ____ ___
Residual risk
True or False: The primary goal of risk management is not to reduce risk to a level that the organization will accept.
False it IS to reduce risk to a level that the organization will accept
_______ must choose a level of acceptable risk based on their organizational goals.
Management
List some risk response techniques
Avoid - by not providing a service or not participating in a risky activity.
Transfer - to another entity i.e. purchasing insurance or outsourcing
Mitigate - implement controls to reduce risk i.e. up to date antivirus software
Accept - when the cost of a control outweighs a risk, an organization will often accept the risk
A ____ ____/____ is an important task in risk management
Risk assessment/analysis
True or False: Risk assessment quantifies/qualifies risks based on different values or judgments
True
What does a risk assessment first identify?
Assets and asset values
An ____ includes any product, system, resource, or process that an organization values.
Asset
The ____ ___ identifies the worth of the asset to the organization.
Asset value
True or False: The asset value helps an organization focus on the high-value assets and avoid wasting time on low-value assets.
True
True or False: A risk assessment attempts to identify the impact of potential threats and identify the potential harm, and prioritizes risks based on the likelihood of occurrence and impact.
True
True or False: A risk assessment includes recommendations on what controls to implement to mitigate risks.
True
True or False: A risk assessment is a point-in-time assessment or a snapshot.
True
True or False: Risk assessments use quantitative measurements or qualitative measurements
True
______ ____ use numbers, such as monetary figure representing cost and asset values.
Quantitative measurements
______ _____ use judgements
Qualitative measurements
True or False: The asset value is an important element in a qualitative risk assessment
False it is an important element for quantitative risk assessment
The cost of any single loss is _____
Single Loss Expectancy (SLE)
How many times the loss will occur in a year is the _____
Annual Rate of Occurrence (ARO)
The product of the Single loss expectancy and the annual rate of occurrence is _____
Annual loss expectancy (ALE) = SLE X ARO
List two simple guidelines managers use for most risk assessment decisions
- If the cost of the control is less than the savings, purchase it.
- If the cost of the control is greater than the savings, accept the risk.
A _____ ____ ____ uses judgement to categorize risks based on probability and impact
Qualitative Risk Assessment
The probability that an event will occur is _______
Likelihood of occurrence
Quality is often a matter of _______
Judgement
One of the challenges with a qualitative risk assessment is gaining ______ on the probability and impact.
Consensus
True or False: A final risk assessment report is highly protected
True. The information that is contained such as management decisions on what controls and measures are to be implemented are valuable esp to an attacker. Normally, only executive management and security professionals will have access to these reports.
True or False: There are different definitions for a risk register depending on which standard you are following.
True.
ISO 73:2009 defines as a record of information about identified risks
Projects IN Controlled Environments defines as a repository for all risks identified and includes additional information about each risk
List some fields that are defined in a risk register
Category Specific Risk Likelihood of occurrence Impact Risk score Security controls or mitigation steps Contingencies Risk score with security controls Action assigned to Action deadline
A _____ ____ _____ evaluates the raw materials supply sources and all the processes required to create, sell, and distribute a product
Supply chain assessment
List two common tools used by security administrators to test networks
- Vulnerability scanners
2. Penetration tests
True or False: By reducing vulnerabilities you can reduce risks
True
What is the overall goal of a vulnerability assessment?
To assess the security posture of systems and networks.
List some sources that vulnerability assessments include information from
- Security policies
- Logs
- Interviewing personnel
- Testing systems
List the high-level steps for a vulnerability assessment
- Identify assets and capabilities
- Prioritize assets based on value
- Identify vulnerabilities and prioritize them
- Recommend controls to mitigate serious vulnerabilities
True or False: Many organizations do not perform vulnerability assessments internally
False
True or False: Organizations hire external security professionals to complete external assessments
True
A ____ ____ attempts to discover a password
Password cracker
True or False: Password crackers are one of the tools security administrators use during a vulnerability assessment
True
An _____ password cracker attempts to discover passwords by analyzing a database or file containing passwords.
Offline
True or False: A key benefit of an offline password cracking attack is that attackers have unlimited time to analyze the passwords
True
An _____ password cracker attempts to discover passwords by guessing them in a brute force attack.
Online
A _____ _____ uses various techniques to gather information about hosts within a network.
Network scanner
True or False: Nmap is an unpopular network scanning tool
False. It is popular
True or False: Other popular network scanners are netcat and nessus
True
A _____ ___ sends an ICMP ping to a range of IP addresses in a network
Ping scan
True or False: A problem with ping scans is that firewalls often block ICMP, so it can give inconsistent results.
True
___ ___ ___ sends an ARP packet with an IP address to a host and the corresponding host responds with its MAC address
ARP ping scan
____ ___ _____ sends a single SYN packet to each IP address in the scan range. If a host responds, the scanner knows that a host is operational with that IP address.
Syn stealth scan
True or False: In a syn stealth scan once a host IP address is confirmed a RST (reset) response is sent to close the connection
True
___ ___ checks for open ports on a system
Port scan
True or False: A port scan typically uses the ports identified as well-known ports by the Internet Assigned Numbers Association (IANA)
True
____ ___ is like a port scan but verifies the protocol or service.
Service scan
___ ___ _____ techniques analyze packets from an IP address to identify the OS.
Operating System (OS) Detection
OS Detection is often referred to as ____ _______
TCP/IP fingerprinting
True or False: OS Detection techniques don’t rely on a single value but typically evaluate multiple values included in responses from systems
True
____ ____ discovers devices on the network and how they are connected with each other.
Network mapping
