Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CRISC > IT risk assessment > Flashcards

IT risk assessment Flashcards

1
Q

what is risk assessment?

A

process used to identify and evaluate risk and its potential effects, which includes evaluation of the

  • critical functions necessary for an enterprise to continue business operations
  • risk associated with each of the critical functions
  • controls in place to reduce exposure and their cost
  • prioritization of the risk on the basis of their likelihood and potential impact
  • relationship between the risk and the enterprise risk appetite and tolerance
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

what is a Bayesian analysis

A

method of statistical inference that uses prior distribution data to determine the probability of a result

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

what is business impact analysis

A

process to determine the impact of losing the support of any resource. in addition to identifying initial impact, a comprehensive BIA seeks to establish the escalation of loss over time. the goal of a BIA is to provide reliable data on the basis of whether senior management can make the appropriate decision

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

what is a fault tree analysis?

A

starts with an event and examines possible means for the event to occur (top-down) and displays these results in a logical tree diagram.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

what is an event tree analysis?

A

forward looking , bottom up model that uses inductive reasoning to assess the probability of different events resulting in possible outcomes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

what is a cause and consequence analysis

A

combines techniques of a fault tree analysis and an event tree analysis and allows for time delays to be considered

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

what is a cause and effect analysis

A

looks at factors that contributed to a certain effect and groups the causes into categories (using brainstorming), which are then displayed using a diagram, typically a tree structure or a fishbone

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

what is a hazard analysis and critical control points?

A

originally designed for the food safety industry, this system proactively prevents risk and assures quality, reliability and safety of processes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

what is Hazop

A

structured means of identifying and evaluating potential risk by looking at possible deviations from existing processes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

what is human reliability analysis?

A

HRA examines the effect of human error on systems and their performance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

what is layers of protection analysis

A

LOPA is a semi-quantitative risk analysis technique that uses aspects of HAZOP data to determine risk associated with risk events. it also looks at controls and their effectiveness.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

what is a markov analysis

A

Markov analysis is used to analyze systems that can exists in multiple states

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

what is a preliminary hazard analysis?

A

looks at what threats or hazards may harm an organization’s activities, facilities or systems. the result if a list of potential risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

reliability centered maintenance

A

analyzes the functions and potential failures of a specific asset, particularly a physical asset such as an equipment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

sneak circuit analysis

A

use to identify design errors or sneak conditions such as latent hardware, software or integrated conditions that are often undetected by system tests and ma result in improper operations, loss of availability, program delays or injury to personnel.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

what are policies

A

policies provide direction regarding acceptable and unacceptable behaviors and actions to the organization. standards and procedures support the requirements defined in the policies set by the organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

what are the different level of policies ?

A

High level policy: issued as a way to address the objectives of the organizations mission and vision statement. this policy does not have a technical focus in order to prevent it from becoming outdated when technology changes

technical and functional policy: include specifics regarding technology use. these policies are subject to change as technology changes and new systems are developed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

what are some considerations that affect risk assessment related to technology?

A
  • age of equipment
  • expertise available for maintenance
  • variety of vendors/suppliers
  • documentation of systems
  • availability of replacement parts
  • ability to test systems or equipment
  • operating environment and user expertise
  • ability to patch/mitigate vulnerabilities
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

why is it important to have an enterprise approach to architecture?

A

the lack of an enterprise architecture results in ownership gaps between systems and unclear areas of responsibility for incident or configuration management.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

List the control categories

A

o Preventative controls: inhibit attempts to violate security policy. E.g. encryption, user authentication and vault construction doors
o Deterrent: provide warnings that may dissuade threat agents from attempting compromise. E.g. warning banners on login screen and rewards for the arrest of hackers
o Directive: mandate behavior by specifying what actions are and are not permitted. E.g. a policy
o Detective: provide warning of violations or attempted violations of security policy. Audit trails, intrusion detection systems and checksums
o Corrective: remediate errors, omissions, unauthorized uses and intrusions when detected. E.g. data backups, error correction, and automated failover are examples of corrective controls
o Compensating: an alternate form of a control that corrects a deficiency or weakness in the control structure of the enterprise. This may be considered when an entity cannot meet a stated requirement due to legitimate technical or business constraints but can create a comparably accepted level of risk by other means. E.g. placing unsecured systems on isolated network segments with strong perimeter security and adding third-party challenge-response mechanisms to devices that do not support individual login accounts.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

with respect to the control environment, list the cases where risk is serious?

A

o Controls are inadequate,
o the wrong controls are being used,
o controls are ignored or bypassed,
o controls are poorly maintained,
o logs or control data are not reviewed,
o controls are not tested,
o changes to the configuration of controls are not managed,
o controls can be physically accessed and altered,
o duties are inadequately segregated. Individuals are able to perform two or more of the following
• approve changes, make changes, monitor changes, analyze changes, report on changes.

22
Q

what is a control current state assessment?

A

refers to the condition of the program at a point in time.

23
Q

what are some tools used to determine the current state of IT risks?

A
  • Audits
  • business continuity plans
  • capability maturity model
  • control tests
  • incident reports
  • IT operations and management evaluation
  • enterprise architecture assessment
  • logs
  • media reports of new threats and vulnerabilities
  • observation
  • self assessment
  • third party assurance
  • user feedback
  • vendor reports
  • vulnerability assessment and penetration tests
24
Q

what is the purpose of a business continuity plan?

what is the goal of bcp?

A

enable a business to continue critical services in the event of a disruption, up to and including the ability to survive a disastrous interruption.

the goal of a bcp is to provide a reduced but sufficient level of functionality in the business operations immediately after encountering an interruption and while recovery is taking place.

25
Q

what is the first step for a new BCP?

A

identify the business process of strategic importance, meaning those key processes that are responsible for both the permanent growth of the business and for the fulfillment of the business goals.

26
Q

what is the core source of data used in the bcp planning?

A

Business impact analysis, which identifies the critical time lines for services and products associated with value creation.

27
Q

what is an RPO and RTO?

A

Recovery point objective: defines how much data can be lost in recovery.

Recovery time objective: how quickly it must be accomplished.

28
Q

what is disaster recovery?

A

refers to the reestablishment of business and IT services following a disaster or incident within a predefined schedule and budget. a comprehensive DRP includes specific information on hardware and software requirements for restoration, which systems and applications should be restored in what order, how to accomplish the restorations under multiple scenarios, and how many user longs are required in what time frames.

29
Q

what is the function of a capability maturity model?

A

used to compare the state of the organization’s risk management program to an established model of capability maturity, which captures the essential elements of effective processes for one or more disciplines.

30
Q

what is incident management?

A

incident management starts with the preparation and planning that build an incident response plan. The organization should prevent incidents where possible but also have the controls in place to detect and respond to an incident when it occurs.

31
Q

what is the primary focus of an incident management?

A

to get the organization’s affected systems and operations back into normal service as quickly as possible.

  • help with information gathering for evidence collection
  • each incident can be examined to extract lessons learned to improve prevention, detection and recovery from future incidents of a similar nature.
32
Q

what is enterprise architecture?

A

focuses on producing a view of the current state of IT, establishing a vision for a future state and generating a strategy to get there. this view should demonstrate links between IT and organizational objectives and produce a view of current risk and controls.

33
Q

why are log reviews important

A

log reviews can identify risk-relevant events such as compliance violations, suspicious behavior, errors, probes or scans and abnormal activity.

34
Q

what are NDA

A

they are necessary to protect the IP of the organization from being disclosed to unauthorized personnel

35
Q

list and describe the phases in SDLC

A
  1. Initiation: the need for an IT system is expressed and the purpose and scope of the IT system is documented.
  2. development and acquisition: the IT system is designed, purchased, programmed, developed or otherwise constructed
  3. implementation: the system security features should be configured, enabled, tested and verified
  4. operation and maintenance: the system performs its functions. typically the system will undergo updates or changes to hardware and software and may be altered due to changes to organizational processes, policies and procedures.
  5. disposal: disposition of information, hardware and software. activities may include moving, archiving, discarding or destroying information and sanitizing the hardware and software.
36
Q

describe how risk is imbedded in the SDLC

A
  1. initiation: identified risk is used to support the development of the system requirements, including security requirements and a security concept of operations (strategy)
  2. development and acquisition: risk identified during this phase can be used to support security analyses of the IT system that may lead to architecture and design trade-offs during system development.
  3. implementation: decisions made regarding risk must be made prior to system operations
  4. operation and maintenance: risk management activities are performed for periodic system reauthorization or reaccreditation or whenever major changes are made to the IT system.
  5. disposal: risk management activities are performed for system components that will be disposed and ensure that residual data are appropriately handled and that system migration is conducted in a secure and systematic manner.
37
Q

what are key tasks to perform during the SDLC to expressly document the risk associated with the development of a new program.

A
  1. security categorization of the proposed system; CIA requirements.
  2. BIA; what impact would an outage have on critical business processes?
  3. PIA: what laws or regulations apply? what sensitive data are processed, stored or transmitted by the system?
  4. training for staff and a secure environment? good code practices
  5. awareness of vulnerabilities with selected technology or operational environment
38
Q

what is a sensitivity analysis?

A

a quantitative risk analysis technique that

  • helps determine which risk factors potentially have the most impact
  • examines the extent to which the uncertainty of each element affects the target object when all other uncertain elements are held at their baseline values.
39
Q

what is threat modelling?

A

examines the nature of the threat and potential threat scenarios. it is done by mapping potential methods, approaches, steps and techniques used by an adversary to perpetrate an attack.

helps build systems with attention to defensive controls, built in security features and proper placement within a strategy of overlapping defenses.

40
Q

what is use case modelling

A

examines how a system will function to deliver value to its users. looks at all the possible errors, mistakes, and intentional deviations from expected user behavior that a system could endure.

helps ensure that a system is built with resiliency and ability to handle errors and misuse

41
Q

what is a gap analysis?

A

a process of documenting the desired state or condition of risk that management wants to reach and then carefully analyzing and evaluating the current conditions of the organization, the risk practitioner can identify the existence of a risk gap and the scope of actions that may be needed to close the gap

current state = KPI or KGI
desired state = KRI

42
Q

what is a threat based scenario and when is it commonly used?

A

Threat based scenario examines a risk event on the basis of threat agents and seeks to identify potential methods of attack. this method is especially beneficial when examining the emergence of new threats and determining the risk related to APTs

43
Q

what is a vulnerability based approach?

A

examines the organizations known vulnerabilities and then attempts to anticipate threats that could exploit those vulnerabilities, projecting from those the consequence and magnitude of impact

44
Q

what is an asset/impact approach?

A

based on the identification of critical and sensitive assets and the potential ways that these could be damaged

45
Q

what is risk ranking?

A

using the results of an assessment to place risk in an order that can be used to direct the risk response effort

46
Q

what is OCTAVE?

A

OCTAVE focuses on critical assets and the risk to those assets using a comprehensive, systematic, context-driven and self-directed evaluation approach.

  • phase 1 : build asset-based threat profiles (org evaluation)
  • phase 2: identify infrastructure vulnerabilities (tech evaluation)
  • phase 3: develop security strategy and mitigation plans (strategy and plan development)
47
Q

describe risk appetite bands

A
  • risk within the risk appetite = acceptable
  • risk outside the appetite but within tolerance = unacceptable
  • risk that is outside tolerance = really unacceptable
48
Q

describe the IT assessment report

A

indicates any gaps between the current risk environment and the desired state of IT risk, advise whether these gaps are within acceptable levels, and provide some basis on which to judge the severity of the identified issues. the report should also judge the process used as well as the result of the risk assessment.

49
Q

when would an enterprise project management department primarily use risk analysis?

A
  • during a go/no go decisions
50
Q

the most effective method to conduct a risk assessment on an internal system in an organization is to start by understanding the

A

system and its subsystems

51
Q

what is reasonableness?

A

considers reliability, validity and duplicate transactions. it identifies values that are substantially different from the norm, and routes them for additional scrutiny

CRISC (5 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions