IS Risk Assesments

Question 1

What are the three possible IAP threat categories?

Answer 1

1) Intentional
2) Natural
3) Inadvertent

Question 2

What are the 8 steps of an IAP Risk Assessment Process?

Answer 2

1) Identify information assets
2) Valuate information assets
3) Assess threats to information assets. Likely adversaries4) Assess likelihood of threat occurrence
5) Identify existing and projected vulnerabilities
6) Asses the impact of a loss event or disclosure on the organization
9) Identify existing and planned security controls or other options for addressing risk.
8) Assess and prioritize risk based on the likelihood and organizational impact.

Question 3

What is the difference between Residual Risk and Residual Threat Risk? What is the qualitative fundamental equation of ISS?

Answer 3

Residual Threat Risk is the leftover risk for each threat. Residual Risk is the total leftover risk for all risks.

Residual Risk = (Threats*Vulnerabilities)/Countermeasures

Question 4

What is an information system threat?

Answer 4

Any circumstance, capability, action, or event with the potential to adversely impact an information system.

Question 5

Information Systems Vulnerability

Answer 5

A flaw or weakness in an information systems design that could be exploited to violate a system’s security policy.

Question 6

What is the Information System Risk equation?

Answer 6

(level of threat) * (level of vulnerability)

Question 7

When should an ISS risk assessment be carried out?

Answer 7

A regular and systematic basis to address changes that may occur in the business environment as well as security requirements and the nature of in the information assets, threats, vulnerabilities and impacts.