Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Domain 1: Risk Analysis > Flashcards

Domain 1: Risk Analysis Flashcards

1
Q
  • Valuable resources that need protection

- i.e. data, systems, people, buildings, property, etc.

A

Assets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q
  • Potentially harmful occurrence

- i.e. hacker, earthquake, power outage, etc.

A

Threat

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

A weakness that can allow a threat to cause harm

A

Vulnerability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Formula to calculate risk:

A

Risk = Threat * Vulnerability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Variables that represent the severity of damage, sometimes expressed in dollars.

A

Impact

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What other variable is sometimes added to the risk equation?

A

Risk = Threat * Vulnerability * Impact

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Uses a quadrant to map the likelihood of a risk occurring against the consequences (or impact) that risk would have.

A

Risk Analysis Matrix

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Calculation that allows you to determine the annual cost of a loss due to a risk.

A

Annualized loss expectancy (ALE)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

The value of the assets you are trying to protect

A

Asset Value (AV)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Percentage (%) of value an asset loses due to an incident

A

Exposure Factor (EF)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q
  • Calculated by AV * EF

- The cost of a single loss

A

Single-Loss Expectancy (SLE)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

The number of losses suffered per year

A

Annual Rate of Occurrence (ARO)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q
  • Calculated by SLE * ARO

- Yearly cost due to a risk

A

Annualized Loss Expectancy (ALE)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

The overall cost associated with mitigation using a safeguard.

A

Total Cost of Ownership (TCO)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

The amount of money saved by implementing a safeguard

A

Return on Investment (ROI)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

If the annual Total Cost of Ownership (TCO) is less than your ALE

A

Your have a positive ROI and have made a good choice with your safeguard implementation

17
Q

If the annual Total Cost of Ownership (TCO) is higher than your ALE

A

You’ve made a poor choice as it relates to safeguard implementation

18
Q

What three factors play a big part in determining the cybersecurity budget?

A
  1. Risk analysis
  2. Total Cost of Ownership (TCO)
  3. ROI
19
Q
  • Risk choice
  • Sometimes it is cheaper to leave an asset unprotected, rather than make the effort and spend the money to protect it.
  • Risks assessed as low likelihood are candidates for this risk
A

Accept the Risk

20
Q
  • Risk choice

- Lowering a risk to an acceptable level

A

Mitigating Risk

21
Q
  • Risk choice
  • Risk is moved to another entity allowing them to handle the liability
  • i.e. Insurance companies they are experts in handling risks
A

Transferring Risk

22
Q
  • Risk choice
  • The process of choosing an alternate option that has less risk associated with it,
  • i.e. Choosing to locate a business in Arizona instead of Florida to avoid hurricanes
A

Risk Avoidance

23
Q
  • Risk choice

- Denying that a risk exists (not acceptable)

A

Risk Rejection

24
Q

The lowering of risk

A

Risk Reduction

25
Q

The risk management process

A

Risk Analysis

26
Q

The amount of risk an organization would face if no safeguards were implemented

A

Total Risk

27
Q

Formula for total risk

A

Threats * vulnerabilities * asset value = total risk

* does not imply multiplication, but a combination function

28
Q
  • Assigns real dollar figures to the loss of an asset

- i.e. Calculating ALE

A

Quantitative Risk Analysis

29
Q
  • Assigns subjective and intangible values to the loss of an asset
  • i.e. The risk analysis matrix
A

Qualitative Risk Analysis

30
Q

Combines quantitative risk analysis for risks that can be expressed in numbers i.e. money and qualitative analysis for the remainder.

A

Hybrid Risk Analysis

31
Q

What are the 6 steps of the risk management framework?

A
  1. Categorize
  2. Select
  3. Implement
  4. Assess
  5. Authorize
  6. Monitor
32
Q

Cost/benefit calculation (analysis)

A

ALE before safeguard - ALE after implementing the safeguard - annual cost of safeguard (ACS) = value of the safeguard to the company

33
Q
  • The risk that management has chosen to accept rather than mitigate
  • Difference between Total risk and Controls gap
A

Residual Risk

34
Q
  • The amount of risk that is reduced by implementing safeguards
  • Difference between Total risk and Residual risk
A

Controls Gap

CISSP (30 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions