Lesson 15: Explain Risk Management Processes Flashcards
Define ‘risk management’
Identifying potential issues, assessing their potential impact on the organization, and implementing controls to mitigate them.
What are key concepts of effective risk management?
Risk identification, risk assessment, mitigation, and monitoring.
What is the purpose of audits?
To provide an independent and objective evaluation of processes, controls, and compliance, ensuring adherence to standards and identifying gaps that pose risks.
What is the purpose of an assessment?
To evaluate the effectiveness of risk management strategies, identify potential vulnerabilities, and prioritize mitigation efforts.
What is the importance of audits and assessments?
To understand risks, implement controls, and continuously monitor and adapt risk management strategies.
Define ‘risk identification’
Process of listing sources of risk due to threats and vulnerabilities.
What are common risk identification methods?
Vulnerability assessments, penetration testing, security audits, threat intelligence.
Define a ‘risk assessment’
Process of identifying risks, analyzing them, developing a response strategy for them, and mitigating their future impact.
What are the different risk assessment methods?
Ad hoc, recurring, one-time, or continuous.
Define ‘risk analysis’ relative to risk assessment
The distinct process of identifying and evaluating potential risks and the nature and scope of risks by examining their causes, consequences, and concerns.
Define ‘risk assessment’ relative to risk analysis
Risk assessment considers the likelihood of an event occurring and the severity of its consequences by interpreting data collected during risk analysis.
Define ‘Quantitative risk analysis’
A numerical method that is used to assess the probability and impact of risk and measure the impact.
Define ‘Single Loss Expectancy (SLE)’
The amount that would be lost in a single occurrence of a particular risk factor.
Define an ‘exposure factor (EF)’
The percentage of an assets value that would be lost in an event.
How is Single Loss Expectancy (SLE) calculated?
By multiplying the value of the asset by the exposure factor (EF).
Define ‘Annualized Loss Expectancy (ALE)’
The total cost of a risk to an organization on an annual basis.
Define an ‘annualized rate of occurrence (ARO)’
The number of times an event could occur in a year in terms of probability/likelihood.
How is Annualized Loss Expectancy (ALE) calculated?
By multiplying the SLE by the annual rate of occurrence (ARO).
Define ‘Qualitative risk analysis’
Assess risks based on subjective judgment and logic rather than precise numerical data.
How is qualitative risk analysis performed?
Qualitative risk analysis frames risks by considering their causes, consequences, and potential interdependencies.
Define ‘inherent risk’
Risk that an event will pose if no controls are put in place to mitigate it; The level of risk before any type of mitigation has been attempted.
Is it possible to eliminate risk?
It is not possible to eliminate risk.
What is the ultimate goal of risk management?
To mitigate risk factors to the point where the organization is exposed only to a level of risk that it can tolerate.
What term is used to describe an organizations overall status of risk management?
Risk/security posture.
Define ‘risk mitigation’
Overall process of reducing exposure to or the effects of risk factors.
Define ‘risk deterrence/reduction’
The response to risk identification/analysis by deploying security controls to reduce the likelihood and/or impact of a threat scenario.
Define ‘risk avoidance’
The practice of ceasing activity that presents risk.
Define ‘risk transference/sharing’
Moving or sharing the responsibility of risk to another entity; typically cyber insurance.
Define ‘risk acceptance’
Risk tolerance; Determining that a risk is within the organization’s appetite and no countermeasures other than ongoing monitoring is needed.
Define ‘risk exception’
Describes a situation where a risk cannot be mitigated using standard risk management practices or within a specified time frame due to financial, technical, or operational conditions.
Define ‘risk exemption’
A condition where risk can remain without mitigation, usually due to a strategic business decision.
Define ‘residual risk’
Risk that remains even after controls (mitigation/transference/exemption/exception) are put into place.
Define ‘risk appetite’
How much risk and what types of risk an organization is willing to take to fulfill its organizational goals and objectives.
In order, list the 5 phases of risk management
- Identify Mission Essential Functions
- Identify Vulnerabilities
- Identify Threats
- Analyze Business Impacts
- Identify Risk Response
What are the two main variables when calculating risk?
Likelihood and Impact.
Define ‘risk likelihood’
Qualitative analysis used to describe the chance of a risk event happening; Low/Med/High or on some form of a numeric scale.
Define ‘risk impact’
The severity of the risk if realized as a security incident.
Define ‘risk probability’
Quantitative measure typically expressed as a numerical value to precisely measure the chance of a risk event occurring based on statistical methods.
What are NIST’s Risk Management Framework (RMF) or ISO 31K?
They are enterprise risk management (ERM) policies and procedures.
Define a ‘risk register’
A document showing the results of risk assessments that includes information regarding risks, their severity, the associated owner of the risk, and all identified mitigation strategies.
Define a ‘risk threshold’
Determines risk acceptance; defines the limits or levels of acceptable risk an organization is willing to tolerate.
What are factors that define a risk threshold?
Regulatory requirements, organizational objectives, stakeholder expectations, and the organization’s risk appetite.
Define ‘Key Risk Indicators (KRIs)’
Metrics that provide an early indication of increasing risk exposures in different areas of the organization.
Define a ‘risk owner’
An individual who is accountable for developing and implementing a risk response strategy for a risk documented in a risk register.
