Domain 3 - Risk Identification, Monitoring, and Analysis Flashcards
Risk
A function of the likelihood of a given threat source’s exercising a potential vulnerability, and the resulting impact of that adverse event on the organization.
NIST 800-30 R1
Risk Management Guide for Information Systems
Likelihood
The probability that a potential vulnerability may be exercised within the construct of the associated threat environment.
Threat Source
Either intent and method targeted at the intentional exploitation of a vulnerability or a situation or method that may accidentally trigger a vulnerability.
Threat
The potential for a threat source to exercise (accidentally trigger or intentionally exploit) a specific vulnerability.
Vulnerability
A flaw or weakness in system security procedures, design, implementation, or internal controls that could be exercised and result in a security breach or a violation of the system’s security policy.
Impact
The magnitude of harm that could be caused by a threat’s exercise of a vulnerability.
Asset
Anything of value that is owned by an organization. Assets include both tangible items such as information systems and physical property and intangible assets such as intellectual property.
Risk Management
Process of identifying risks, assessing their potential impacts to the organization, determining the likelihood of their occurrence, communicating findings to management and other affected parties, and developing and implementing risk mitigation strategies to reduce risks to levels that are acceptable to the organization.
Risk Assessments
Assess threats to Information Systems, system vulnerabilities, and weaknesses, and the likelihood that threats will exploit these vulnerabilities and weaknesses to cause adverse effects.
NIST Risk Assessment Process
Step 1: Prepare for Assessment
Step 2: Conduct Assessment
Step 3: Communicate Results
Step 4: Maintain Assessment
Threat Statement
Given after the threat identification process, and lists potential threat sources that could exploit system vulnerabilities.
NIST Risk Assessment: Conduct Assessment Step
- Identify Threat Sources and Events
- Identify Vulnerabilities and Predisposing Conditions
- Determine Likelihood of Occurrence
- Determine Magnitude of Impact
- Determine Risk
SLE
Single Loss Expectancy
Represents the expected monetary loss to an organization from a threat to an asset.
ALE
Annualized Loss Expectancy
Expected annual loss because of a risk to a specific asset.
