Personnel Security and Risk Management Concepts Flashcards
What is the first step in hiring
Job Description
What is the purpose of job responsibilities
Defines work tasks and defines what a person should be responsible for
Process of adding new employees to the org, having them review/sign employment agreements and policies, and receive training on employee operations/logistics.
Onboarding
Why is it important to have a good IAM?
Identity and Access Management:
- provisions account
- assigns privileges
- assigns accesses
Describe the principle of least privilege
Users should have the least amount of privilege required to do their job.
What must happen when a user leaves their job and why?
Review NDA - it is the one legally binding document that safeguards against disclosure.
Why enforce mandatory vacations?
Used as a peer review process
- verify privileges of employees
- attempt to detect fraud and abuse..
What is UBA
User Behavior Analytics: analyze the behavior of users, visoitors, customers, etc. for some specific goal.
When would you go through offboarding processes ie remove someone from IAM
Hire | Fire | Transfer
What is a risk that exists when several entities or organizations are involved in a project?
Multiparty Risk
Define SLA
Service Level Agreement: Ensure that organizations providing services maintain an appropriate level of service agreed on by both the service provider, vendor, or contractor and the customer organization.
What is the type of risk response option that is used in the process of outsourcing
assignment/transferrence
The detailed process of identifying factors that could damage or disclose assets, evaluating those factors in light of asset value and countermeasure cost, and implementing cost-effective solutions for mitigating risk.
Risk Management
Examination of the environment for risks, evaluating each threat event as to its likelihood of occurring and the severity of the damage it would occur.
Risk Assessment - probability
Evaluating countermeasures, safeguards, and security controls using a cost/benefit analysis
Risk Response - implementing countermeasures
Asset
Anything used in business process or task - person, place, or thing, tangible or intangible.
Asset valuation
the value assigned to an asset based on actual cost, use in critical processes, and even non-monetary expense such as time
Threats
any POTENTIAL OCCURENCE that may cause an undesirable or unwanted outcome
Threat agents
usually people but could be programs, hardware or systems
Threat events
accidental occurences and intentional exploitations of vulnerabilities: system failures fires flood earthquake human error power outage
Threat vector
means by which an attack or attacker can gain access to target in order to cause harm
Vulnerability
weakness in asset or weakness of a safeguard
loophole
limitation
susceptibility
Exposure
Being susceptible to asset loss because of risk
Risk (math and definition)
possibility or likelihood that threat will exploit a vulnerability to cause harm to an asset and severity of damage.
Risk = threat * vuln
Risk = probability of harm * severity of harm
Safeguard
security control, protection mechanism, countermeasure
Attack
intentionally attempted exploitation of a vulnerability
Breach
successful attack - intrusion or penetration beyond a security mechanism
Asset-Based Valuation
Start with inventorying all organizational assets and valuing them based on tangible and intangible issues.
Which method is preferred? Quantitative risk analysis or Qualitative risk analysis?
Neither - both methods are valuable to gain a balanced view of the security concerns.
Qualitative Risk Analysis
Assign subjective and intangible values to the loss of an asset. (can be SUBJECTIVE)
Quantitative Risk Analysis
Assign a real dollar figure to the loss of an asset-based on math calculations. (mostly OBJECTIVE)
An anonymous feedback and response process used to enable a group to reach an anonymous consensus.
Delphi Technique
Calc EF
Exposure Factor/ Loss potential
% loss that org would experience if the specific assets were violated by realized risk.
Potential loss associated with a single realized threat against a specific asset.
SLE - Single loss expectancy
SLE = asset value AV * exposure factor EF
What is the SLE of an asset valued at $300,000 that has an exposure factor of 30%
0.3*300,000 = $90,000
The expected frequency with which a specific threat or risk will occur within a single year
The annualized rate of occurrence.
The possible yearly loss of all instances of a specific realized threat against a specific asset.
Annualized Loss Expectancy
ALE = Single loss expectancy * Annual Rate of Occurrence
ALE = AV * EF * ARO
What is ALE for $200,000 asset with an EF of 45% and an ARO of .67
$60,000
Risk Mitigation
Reducing risk through the implementation of safeguards, security controls, and countermeasures. Ie deploying encryption and using firewalls.
