L10 - Risk Analysis and Information Security Strategy Flashcards
What is risk management?
The main goal is to develop and implement information security strategies, which in turn reduce the risk to an acceptable level.
What is risk analysis?
The process by which the goals of risk management are acheived.
How does risk analysis work?
It:
* Examines an environment for risks
* evaluate how likely a threat event is to occur
* evaluate the cost to assets if the thread were to occur
* assessing the cost of various countermeasures for each risk
* Create a cost/benefit report for safeguard to present to management.
Risk terminology
What is an asset?
It’s a system resource or cability of value to it’s owner which should be protected.
Risk terminology
What is asset valuation?
The monetary value of an asset based on the actual cost (e.g replacement cost) and nonmonetary expense.
Risk terminology
What is a threat?
a potential threat source to exploit a vulnerability in an asset, in turn if it occurs it may compromise security of said asset and cause its owner harm.
Risk terminology
What is vulnerability?
A flaw or a weakness in an asset, it could be in it’s design, implementation, operation or management.
Risk terminology
What is exposure?
It’s how likely it is that a vulnerability can or will be exploited by a threat agent or event.
Risk terminology
What is risk?
It’s the potential loss a owner would suffer due to a threat exploiting a vulnerability. And the magnitude this consequence would have on an assets owner.
Risk terminology
What is safeguards?
Also called countermeasure
is anything that would remove or reduce a vulnerability or protect against one or more specific threats.
What is asset identification?
An asset is anything that needs protection, to identify such an asset drawing expertise from people in relevant areas of the organization is the way to go.
What is thread identification?
It’s the creation of an exhaustive list of all possible threats, which could be:
* Viruses
* Misuse of data
* malicious hackers
* criminal activities
* disgruntled employees.
* etc.
What is vulnerability identification?
It’s the process of identifying exploitable flaws or weaknesses in organizations IT-systems or processes.
It’s outcome should be a list of threats and vulnerabilities of how and why they might occur.
What is the difference between qualitative and quantitative risk analysis?
- Quantitative: values from the mathematical domain like the probaility space. It can be performed by assigning monetary values and probabilities to threats and assets.
- Qualitative: values aren’t from the domain of mathematics, instead risk is calculated based on rules that capute the consolidated advice of security experts.
How is a risk calculated?
the risk is calculated based on the monetary value of the asset and the probaility of the likelhood that a threat would occur.
Only applies to quantitative risk analysis.
What are the 5 risk treatment alternatives?
- Risk acceptance
- Risk avoidance
- Risk tranfer
- Reduce consequence
- Reduce likelyhood
Risk treatment alternatives
What is risk acceptance?
Chosing to accept a risk level greater than normal for business reasons.
Risk treatment alternatives
What is risk avoidance?
Not proceeding with the activity or system that creates a specific risk.
Risk treatment alternatives
What is risk transfer?
Sharing a responsibility for the risk with a 3rd party.
Risk treatment alternatives
What is reduce consequence?
Altering the structure or the use of the asset at risk in order to reduce the impact on the organization should that risk occur.
Risk treatment alternatives
What is reduce likelyhood?
Implement suitable controls to lower the change of the vulnerability being exploited.
What is an attack surface?
It’s the reachable and exploitable vulnerabilities in a system.
What are the 3 attack surface categories?
- Network attack surface
- Software attack surface
- Human attack surface
Attack surface categories
What is the network attack surface?
It’s the vulnerabilities over an enterprise network, wide-are network or the internet.
Attack surface categories
What is the software attack surface?
It’s the vulnerabilities in application, utility, or operating system code.
Attack surface categories
What is the human attack surface?
It’s the vulnerabilities created by personell or outsiders, such as social engineering, human error and trusted insiders.
What are the 3 control types?
- Physical controls
- Administrative controls
- Technical controls
The 3 control types
What does the physical control contain?
- Facility protection
- Security guards
- Locks
- Monitoring
- Environmental controls
- Intrusion detection
The 3 control types
What does the administrative control contain?
- Policies
- Standards
- Procedures and practice
- Personnel screening
- Awareness training
The 3 control types
What does the technical control contain?
- Logical access control
- Cryptographic controls
- Security devices
- User authentication
- Intrusion detection
- Forensics
What is defense in depth?
also layered security
it’s a principle that is characterized by the use of multiple different defense mechanism. With the goal of improving defensive response to an attack.
How is defense in depth related to to attack surfaces?
- If the attack surface is large, and the defence is shallow the security risk is hich
- And the oposite creates a low security risk.
What are the 3 common security strategies?
- Preventation
- Detection
- Reaction
The 3 common security strategies?
What is the prevention strategy?
Take measures that prevent your assets from being damaged.
The 3 common security strategies?
What is the detection strategy?
take measures so that you can detect, when, how and by whom an asset has been damaged.
The 3 common security strategies?
What is the reaction strategy?
take measures so that you recover your assets or recover from damage to your assets.
What are security goals?
it’s the goal of preventing unauthorized individuals from interfere with CIA, authenticity and accountability.
Security goals
What are suitable controls for C in CIA?
- Encryption
- Access control
- Perimeter defense
Security goals
What are suitable controls for I in CIA?
- Cryptographis integrity check (hashing)
- Access control
- Perimeter defense
- Audit
- Verification of systems and applications.
Security goals
What are suitable controls for A in CIA?
- Redundancy of resources
- Traffic filtering
- Incident recovery
- International collaboration and policing.
What are security control states?
Information is considered to be in one of three possible states.
* During storage
* During transmission
* During processing (use)
All states are considered to be in need of protection.
