Lecture 2

Question 1

risk management

Answer 1

Aims to accept risks that make sense to take and reduce unacceptable risks
(resolving obstacles)

Question 2

Risk management process

Answer 2

1. Assess risks
2. identify risks to manage
3. select controls
4. implement and test controls
5. evaluate controls

Question 3

risk identification process

Answer 3

1. identify threats
2. identify vulnerabilities
3. estimate likelihood of a threat exploiting vulnerability

Question 4

threat

Answer 4

any circumstance or event where potential to adversely impact organisational operations, assets, individuals or the nation via unauthorized access, destruction, disclosure or modification information and/or denial of service

Question 5

Vulnerability

Answer 5

Weaknesses in an information system security procedures, internal controls or implementation that could be exploited by a threat source

Question 6

Asset

Answer 6

any information resource valued by the organisation

Question 7

Top 10 threats to information security

Answer 7

1. Technology with weak secuirty
2. social media attacks
3. social engineering
4. mobile malware
5. third party entry
6. neglecting proper configuration
7. outdated security software
8. Lack of encryption
9. corporate data on personal devices
   10 security technology

Question 8

Types of information risks

Answer 8

1. IS business risk
2. IS security risk
3. IS/business continuity risk
4. IS/IT audit risk
   (Inherent risk, control risk, detection risk)

Question 9

IS business risk

Answer 9

Likelihood that a business will not achieve its business goals and objectives

Question 10

Information security risks

Answer 10

Includes risk associated with confidentiality, integrity, availability (including access) to information

Question 11

IS/business continuity risk

Answer 11

that the information required to meet business needs is available
includes risks associated with and information systems availability and backup and recovery

Question 12

IS/IT audit risk

Answer 12

Likelihood that an organisations external auditor makes a mistake when issuing an opinion attesting to the fairness of its financial statements or that an IT auditor fails to uncover a material error or fraud

Question 13

The measure of IS/IT audit risks

Answer 13

Audit risk = Inherent risk * Control risk * detection risk