IC37M01 - Risk Assessment and Design Phase Overview Flashcards
Passive
This vulnerability assessment discovers networks devices using means including:
- Reviewing drawings
- System walk-through
- Traffic analysis
- ARP Tables
The goal is to discover vulnerabilities by understanding the system and processes and create or update documentation.
High Level
(Gap Assessment)
This assessment evaluates an organization’s existing operational and technical cybersecurity practices. It should provide a comparison of the system to industry regulations, standars and best practices, as well as feedback on performance relative to industry peers. It involves interviews, site-walks, examination of drawings and configurations, and a review of existing policies and procedures.
Penetration Test
The most invasive of cybersecurity vulnerability assessments and the only assessment type where you try to actively exploit the vulnerabilities found in the previous steps. It begins with an active cybersecurity vulnerability assessment that is conducted using the prospective of a potential attacker. It attemps to exploit known and unknown security vulnerabilities, so it can validate the effectiveness of security countermeasures.
Active
This assessment is an invasive vulnerability assessment. It is used discover network devices using active scanning tools and techniques to develop an understanding of the system and may require the creation or update of documentation.
Documents & Reports to Maintain
- Gap Assessment Report
- Vulnerability Assessment Report
- Risk Assessment Report
- Zone & Conduit Diagrams
- Cybersecurity Requirements Specifications
The risk is known and accepted by the organization. The organization is willing to use this approach with this risk.
Tolerate
The risk is passed to a third party, for example an insurer or an outsource, to manage the risk. This does not eliminate the risk.
Transfer
The process, activity, tool, etc. is no longer used. By stopping the usage the risk is no longer relevant.
Terminate
Reduce the likelihood of the threat materializing or the resultant impact by introducing relevant controls and continuity strategies. Mitigating controls are put in place.
Treat
