Informationn Security And Risk Management Flashcards
Risk management
The process of minimising potential losses.
In the case a loss occurs, risk management practices determine how to reduce the costs.
Risk assessment techniques
Risk assessment techniques determine the level of risk and determine if the level of risk exceeds an organisation’s risk tolerance.
NIST
National Institute of Standards and Technology
4 Risk management processes
- framing
- assessing
- monitoring
- responding
Risk assessment
Activities that are carried out to discover, describe, analyse and evaluate risks. They can be quantitative, quantitative or both
Qualitative risk assessment
Collects descriptive information, including information that cannot be reduced to measurable values.
It will typically identify a number is characteristics about an asset or activity, including:
- classification
- vulnerabilities
- threats
- threat probability
- impact
- countermeasures
Classification
Assets may be classified according to risk level, business function of the sensitivity or criticality of data stored or processed by the asset.
Vulnerabilities
These are weaknesses in design, configuration, documentation, procedure or implementation
Threats
Potential activities that would exploit specific vulnerabilities and result in a security incident.
Threat probability
An expression of the likelihood that a specific threat will be carried out, usually expressed in Low/Medium/High or simple numeric scale.
Impact
An expression of the influence upon the organisation if a threat was carried out.
Countermeasures
These are actual or proposed measures that reduce the risk associated with vulnerabilities or threats.
Quantitative Risk Assessment
Quantitative assessments tata assessing and evaluating risks as discrete mathematical valuations.
It can be thought as an extension of qualitative risk assessment.
Asset value
This is a dollar figure that may represent the replacement cost of an asset but it could also represent income derived from the use of that asset.
Exposure Factor
The proportion of an asset’s value that is likely to be lost through a particular threat, usually expressed as a percentage.
Single Loss Expectancy
SLE is the cost of a single Loss through the single event relisation of a particular threat. This is the result of the calculation:
SLE = asset value ($) x exposure Factor (%)
ARO
Annualized Rate of Occurance
The probability that a loss will occur in a year’s time.
ALE
Annual Loss Expectancy
The yearly estimate of a loss of an asset, calculated as follows:
ALE = ARO X SLE
Costs of Countermeasures
Each countermeasure had a specific cost associated with it. This may be the first of additional protective equipment, software or Labour.
Changes in exposure Factor
A specific countermeasure may have an impact on a specific threat.
Changes in single Loss Expectancy
Specific countermeasures may influence the influence the probability that a loss will occur.
Risk Assessment Methodologies
OCTAVE
FRAP
Spanning Tree Analysis
NIST 800-30
Risk Treatment
Once a risk assessment is performed an organisation’s management can begin the process of determining what steps can be taken to manage the risk identified.
The fire general Autriche to risk management are:
- Risk acceptance
- Risk avoidance
- Risk mitigation
- Risk transfer
Risk Avoidance
The associated activity that introduced the risk is discontinued.
