Chapter 9

Question 1

What is Risk Management?

Answer 1

Discovering and assessing risks and how to mitigate them

Question 2

What are 4 key things to understand about risks:

Answer 2

-What is it?
-How bad is it?
-Should we treat it?
-How to treat it?

Question 3

What is Risk Management Framwork and Process? (!!)

Answer 3

Risk Management Framework: The overall structure of planning and design of RM in the organization.

Risk Management Process: The implementation of RM, which happens at the “implementation” phase in the framework.

Question 4

Name the 5 stages of the RM Framework: (!!)

Answer 4

1- Executive governance and support: acknowledgement and approval by seniors to proceed.

2- Design: designing and selecting a RM program.

3- Implementation: implementing the RM process.

4- Monitoring and review: monitoring the RM process cycle.

5- improvement.

Question 5

What is a “Gap Analysis”?

Answer 5

A comparison between the current and expected outcome of the program.

Question 6

Name the 6 phases in the RM Process: (!!)

Answer 6

1- Establishing the context: understanding the environment and process from the framework team.

2- Identifying the risk: includes self examination, then listing the threats and assets.

3- Analyzing the risk: assigning risk scores and understanding the impact of an attack.

4- Evaluating the risk: deciding if the risk should be treated.
If the risk is acceptable the process ends. If not, the next phase proceeds.

5- Treating the risk: protecting assets by modifying the protection methods, or using the help of third parties.

6- Summary of findings.

Question 7

How is self examination of assets done? 3 steps:

Answer 7

1- Identify assets: using asset inventory to assemble different components/assets.

2- Classify and catagorize into groups: catagorizing based on sensitivity and security needs, by using “relative values”.

3- Prioritize: rank/order assets using a weighted table analysis.

Question 8

What is an information asset?

Answer 8

any asset that processes or collects valuable information.

Question 9

What is an Asset Inventory?

Answer 9

Its where organizations keep track of their different assets/components.

Question 10

List 3 potential attributes to track an information asset:

Answer 10

• Name
• IP Address
• MAC Address

Question 11

What is a relative value?

Answer 11

They are comparative judgements to know which assets have more priority, like:
- Which asset generates most income?
- Which asset is most expensive?
etc

Question 12

how many general categories of threats/risks in InfoSec?

Answer 12

12

Question 13

What is the goal of risk assessment?

Answer 13

Getting a risk score for a vulnurability of an asset