Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

My Certification > Principles & Practices 1 > Flashcards

Principles & Practices 1 Flashcards

1
Q

What is Enterprise Security Risk Management (ESRM)?

A

ESRM is a strategic approach to security management that ties an organization’s security practice to its overall strategy using globally accepted and established risk management principles

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are the three primary components of Enterprise Security Risk Management (ESRM)?

A
  1. The content
  2. The foundation
  3. the ESRM cycle
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

This component of Enterprise Security Risk Management (ESRM) includes organizational aspects that security professionals must understand to successfully adopt ESRM.

A

The content

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

This component of Enterprise Security Risk Management (ESRM) includes organizational concepts that support the ESRM approach and maximize its impact.

A

The foundation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

This component ofEnterprise Security Risk Management (ESRM) is the actual process of security risk management that emphasizes the importance of understanding assets.

A

The ESRM cycle

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What organizational aspects are included in the context of Enterprise Security Risk Management (ESRM)?

A
  1. Mission and vision
  2. Core values
  3. Operating Environment
  4. Stakeholders
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What three things comprise the operating environment of an organization?

A
  1. Physical
  2. Nonphysical
  3. Logic
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

This operating environment includes much of what influences traditional security factors, such as the type and location of buildings, industrial control systems, and products on hand.

A

Physical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

These factors are sources of risk, and include things such as the geopolitical environment, intensity of competition, and speed required for decision making.

A

Nonphysical factors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

These factors focus on information types such as servers, workstations, and network infrastructure.

A

Logical factors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are the four processes in the Enterprise Security Risk Management (ESRM) cycle?

A
  1. Identify and prioritize assets
  2. Identify and prioritize risks
  3. Mitigate prioritized risks
  4. Continuous improvement
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is an asset owner?

A

The person most directly responsible for successful operation of the asset. InE nterprise Security Risk Management (ESRM), the asset owner is assigned responsibility for the risk to an asset.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What four concepts comprise the foundation of Enterprise Security Risk Management (ESRM)?

A
  1. Holistic risk management
  2. Partnership with stakeholders
  3. Transparency
  4. Governance
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are two types of assets?

A
  1. Tangible
  2. Intangible
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What are four ways to manage risk?

A
  1. Eliminate
  2. Reduce
  3. Transfer
  4. Accept
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

This risk mitigation strategy involves removing the risk entirely.

A

Eliminate

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

This risk mitigation strategy attempts to minimize risk through protective measures.

A

Reduce

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

This risk mitigation strategy is typically achieved when another entity takes the risk on the organization’s behalf.

A

Transfer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

This risk mitigation strategy allows risk if the costs of reducing, eliminating, or transferring the risk outweigh the potential losses associated with it.

A

Accept

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is a risk assessment?

A

Risk assessment is the identification, analysis, and evaluation of uncertainties to objectives and outcomes
It provides a comparison between the desired/undesired outcomes and expected rewards/losses of organizational objectives
The risk assessment analyzes whether the uncertainty is within acceptable boundaries and within the organization’s capacity to manage risk.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What do the results of a risk assessment inform?

A

The choices available to effectively manage risk to achieve the organization’s outcomes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What are the deciding factors between a qualitative or quantitative approach to a risk assessment?

A

The reliability and validity of the available data
The nature of the risk factors and if they are quantifiable
The target audience for the outputs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is risk appetite?

A

The total exposed amount that an organization wishes to undertake on the basis of risk-return trade-offs for one of more desired and expected outcomes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is risk tolerance?

A

The amount of uncertainty an organization is prepared to accept in total or more narrowly within a certain business unity, a particular risk category, or for a specific initiative.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What tasks take place at the start of the risk assessment?

A
  1. Setting objectives
  2. Identification of stakeholders
  3. Identification of internal context and variables
  4. Documenting assumptions
  5. Defining scope and statement of work
  6. Policy and management commitment
  7. Commitment of resources
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is a gap analysis?

A

A technique to determine what steps might need to be taken to improve from a current state to a desired, future state.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

A gap analysis consists of what three steps?

A
  1. Noting currently available factors
  2. Listing success factors needed to achieve future, desired objectives
  3. Highlighting the gaps that exist and what gaps may need to be filled to be successful
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What four components should be in any risk identification process, regardless of risk discipline?

A
  1. Asset and service identification, valuation, and characterization
  2. Threat and opportunity analysis
  3. Vulnerability and capability analysis
  4. Criticality and impact analysis
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What comprises assessor competence?

A
  1. Personal traits and interpersonal skills
  2. Assessment skills
  3. Communication skills
  4. Education, training, and knowledge
  5. Work experience
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Documented criteria of an assessor’s knowledge and skills provide the basis for what three things?

A
  1. Selection of assessment team members
  2. Ascertain competence enhancement required for continuous improvement
  3. Determine performance indicators for assessors
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What are two types of interactions between a risk assessment team and an organization?

A
  1. Human interaction
  2. Minimal human interactions
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

This type of interaction includes activities such as conducting interviews, document reviews with stakeholders, exercises, and undercover investigations.

A

Human interaction

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

This type of interaction includes activities such as conducting a document review, physical examination, observation, and sampling

A

Minimal human interaction

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What are two examples of assessment paths?

A
  1. Tracing
  2. Process method
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

This assessment path tracks a process or risk event chronologically, following a path forward or backward through a process or sequence.

A

Tracing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

This assessment path tests a sequence of steps and evaluates process controls, interactions, effectiveness, and opportunities for improvement.

A

Process method

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What are some examples of the process method?

A
  1. Objectives method
  2. Risk source method
  3. Department method
  4. Requirement method
  5. Discovery method
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

What is sampling?

A

The process or technique of selecting a representative part of a population for the purpose.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

When is it beneficial to use a sampling method?

A

When it is not practical in time or cost terms to evaluate all available information.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

What are two types of sampling methods?

A
  1. Non-statistical
  2. Statistical
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

This sampling method includes judgmental sampling, convenience sampling, and haphazard sampling.

A

Non-statistical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

This sampling method includes random sampling, systematic sampling, stratified sampling, and cluster/block sampling.

A

Statistical sampling

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

What is terrorism?

A

An act of violence designed to achieve a political end

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

What is domestic terrorism?

A

Violent, criminal acts committed by individuals and/or groups to further ideological goals stemming from domestic influences, such as those of a political, religious, social, racial, or environmental nature.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

What is the primary attack vector of terrorism?

A

To target the public’s sense of security in the location that they reside or work.

46
Q

What is cost-benefit analysis?

A

A method for evaluating and comparing the value and cost of risk treatment options.

47
Q

A cost-benefit analysis should consider what two types of costs and benefits?

A
  1. Direct
  2. Indirect
48
Q

What are examples of direct and indirect benefits?

A

Direct benefits - arising from reduction in the likelihood or harmful consequences of the risk
Indirect benefits - arising from collateral effects of the treatment such as reduced insurance premiums, improved management and staff confidence, and enhanced reputation.

49
Q

What are some examples of direct and indirect costs?

A

Direct costs - of implementing the proposed treatment and/or that could arise if the risk eventuates.
Indirect costs - arising from the loss of productivity, business disruption, diversion of management attention, loss of reputation or brand value.

50
Q

What are the goals of risk treatments?

A
  1. Remove the risk source, where possible
  2. Remove or reduce the likelihood of the risk event occurring
  3. Remove or reduce the negative consequences
  4. Share the risk with other parties
  5. Accept risk through informed decision or to exploit an opportunity
  6. Avoid activities that give rise to risk
51
Q

What is the purpose of a prevention and mitigation procedure?

A

Define the measures to be taken by the organization to minimize the likelihood of a disruptive event or to minimize the potential for the severity of the consequence of the event.

52
Q

What are prevention procedures?

A

Prevention procedures describe how the organization will take proactive steps to protect its assets by establishing architectural, administrative, design, operational, and technological approaches to avoid, eliminate, or reduce the likelihood of risks materializing.

53
Q

What are mitigation procedures?

A

Mitigation procedures describe how the organization will take proactive steps to protect its assets by establishing immediate, interim, and long-term approaches to reduce the consequences of risks before they materialize.

54
Q

What four steps are included in the risk assessment process?

A
  1. Asset identification, valuation, and characterization
  2. Risk identification
  3. Risk analysis
  4. Risk evaluation
55
Q

What happens in the asset identification, valuation and characterization step of the risk assessment process?

A

Identify people, assets and services that provide tangible and intangible value giving consideration to financial, operational, temporal, and reputational characteristics of assets, activities, functions and services.

56
Q

What happens in the risk identification step of the risk assessment process?

A

Identify sources of strategic, operational, tactical, and reputational risk to assess threats and opportunities; vulnerabilities and capabilities; and consequence and criticalities that have a potential for direct or indirect consequences on the organization’s activities, assets, operations, functions and impacted stakeholdersw

57
Q

What happens in the risk analysis step of the risk assessment process?

A

Systematically analyze risk to determine those risks that have significant impact on activities, functions, services, products, supply chain, subcontractors, stakeholder relationships, local populations and the environment.

58
Q

What happens in the risk evaluation step of the risk assessment process?

A

Systematically evaluate and prioritize risk controls and treatments, and their related costs to determine how to bring risk within an acceptable level consistent with risk criteria.

59
Q

What are some outputs of a risk assessment?

A
  1. A prioritized risk register identifying treatments to manage risk
  2. Justification for risk acceptance
  3. Identification of critical control points
  4. Requirements for supplier, distributor, outsourcing and subcontractor controls
60
Q

What six things should be considered when assessing consequences?

A
  1. Human cost
  2. Financial cost
  3. Image cost
  4. Human rights impacts
  5. Indirect impacts
  6. Environmental impacts
61
Q

What changes may prompt an update to a risk assessment?

A

Changes in:
1. Risk landscape
2. Leadership and partnerships
3. Contractual and industry trends
4. Regulatory requirements
5. Political environment
6. Conditions due to an event
7. Performance-based test/exercise results

62
Q

What are five benefits of liaison?

A
  1. Leverage the resources of others
  2. Share best practices and lessons learned
  3. Collaborate on specific cases or incidents
  4. More effectively address common issues
  5. Share information, equipment, and facilities
63
Q

What is cost-effectiveness?

A

Producing good results for the money spent.

64
Q

What three things maximize cost-effectiveness?

A
  1. Ensure that the operations are conducted in the least expensive but cost effective way
  2. Maintain the lowest costs consistent with required operational results
  3. Ensure that the amount of money spent generates the highest return
65
Q

What is security awareness?

A

Consciousness of an existing security program, its relevance, and the effect of one’s behavior on reducing security risks

66
Q

What is the purpose of a security awareness program?

A

To communicate to all individuals, including those working on behalf of the organization, risks within the organization’s unique internal and external environments, and the technical and administrative controls implemented to effectively manage those risks.

67
Q

When is an effective security culture established?

A

When people’s behaviors align with the defined risk management processes and where the security technologies and methods deployed are policy based and well communicated through security awareness and training activities.

68
Q

What is the goal of a security awareness program?

A

To promote compliance with security policies and procedures, as well as provide timely communications and training to guide individual and organizational attitudes and behaviors.

69
Q

What should every awareness program be structured to reflect?

A

The organization’s unique culture, risk environment, lifecycle management, and change control process.

70
Q

How does clear top management support for security awareness set the tone?

A

By actively supporting awareness communication, training, and associated activities. Top management should also be involved in strengthening the culture that ensures individuals understand their security roles and take ownership of their personal safety and security.

71
Q

What three program principles should be established for security awareness programs?

A
  1. Encourage enterprisewide ownership
  2. Develop a unified approach for security awareness communication and training
  3. Leverage existing programs/infrastructure
72
Q

What can be done to encourage enterprisewide ownership of security awareness programs?

A

Establishing an oversight, advisory, or steering group comprised of security stakeholders to influence/generate program content and to help communicate risk appetite, strategy, and content relevance.
Establishing security champions or influencers to solicit and provide input to program content

73
Q

What is a benefit of a unified, holistic approach to security awareness program content?

A

Using ‘one voice’ simplifies the message and increases the impact to stakeholders and the organization.

74
Q

What types of benefits may be realized by leveraging existing organizational programs for security awareness?

A
  1. Timing
  2. Resource
  3. Budget
  4. Logistical
75
Q

What six factors are planning considerations when designing an effective security awareness program?

A
  1. Security policies and procedures
  2. Internal and external considerations
  3. Security risks
  4. Resources
  5. Roles, responsibility, and authorities
  6. Human resources context
76
Q

Effective security policies contain what important characteristics?

A
  1. Protecting individuals and organizational assets from security risks
  2. Organizational relevance and maintaining compliance with legal, regulatory, and contractual obligations are clearly explained
  3. Measurements for continual improvement metrics
  4. Content is written to help build an engaged and alert security community
  5. Instructions should help individuals reflect on the policy, consider how to respond in a situation, and take risk-based, informed, and appropriate actions
  6. Policy cross-references
77
Q

Which department plays a pivotal role as collaborator with security personnel in an organization’s security awareness program?

A

Human resources

78
Q

Security awareness program content should align with what three things?

A
  1. Program goals and objectives
  2. Security policies and procedures
  3. Key performance indicators
79
Q

What factors should be considered when determining how security awareness program content should be delivered?

A
  1. Location-specific needs and requirements
  2. Existing training culture and processes to be leveraged
  3. Traning topic needs
  4. Types of training formats available and relevant
  5. Levels of training required based on security access or employment status
80
Q

What should be included in a security awareness program evaluation?

A
  1. Appropriateness of program goals and objectives
  2. Consistency with the organization’s security policies and procedures
  3. Volume and frequency fo security awareness and training content
  4. Effectiveness of content and delivery methods
  5. Level of resources allocated to the program
81
Q

What should security awareness program improvements be based on?

A
  1. Individual feedback
  2. Program evaluations
  3. Evolving threat landscapes
  4. Changes in the organization’s culture
  5. Audit findings
  6. New or changes to legal, regulatory, or contractual obligations
  7. Top management input and direction
82
Q

What are some benefits of using a security consultant?

A
  1. They do not promote or sell a specific product
  2. Objectivity
  3. Out-of-the-box thinking
  4. Can be less expensive than hiring additional staff
83
Q

What are three categories of security consultants?

A
  1. Security management consultants
  2. Technical security consultants
  3. Security forensic consultants
84
Q

This type of security consultant usually specializes in a certain discipline, which comprises the foundation of their expertise.

A

Security management consultants

85
Q

This type of security consultant has specialized subject matter expertise and specializes in translating security concepts and functionality into blueprints and equipment specifications.

A

Technical security consultant

86
Q

This type of security consultant deals with investigation, identification and collection of evidence, identification of vulnerabilities, mitigation strategies, and litigation.

A

Forensic security consultants

87
Q

In what situation are technical security consultants likely to be used?

A

New construction or renovation projects

88
Q

What are three ways technical security consultants can support construction and renovation projects?

A
  1. Work with the architects and design engineers to ensure the needed security systems are integrated into the initial designs
  2. Uncover security concerns in the plans before they are finalized
  3. Recommend security hardware and software that is compatible with other building systems
89
Q

What is a security advisory committee?

A

An internal rescource formed to assist corporate executives and chief security officers in their efforts to ensure that current security measures are adequate.

90
Q

Who should serve on a security advisory committee?

A

Representatives of key corporate functions with stature and credibility within the organization and sufficient information about the company’s operation to enable them to offer useful opinions about actions that should be taken.

91
Q

What typically drives the decision to use a security consultant?

A

A specific problem, need, challenge, or goal.

92
Q

What are five steps to use when selecting a security consultant?

A
  1. Identify candidates
  2. Invite candidates to submit an application
  3. Evaluate the application
  4. Interview the top two or three candidates
  5. Negotiate an agreement and finalize the selection
93
Q

How can consultant candidates be identified?

A
  1. Suggestions from colleagues and peers
  2. Industry associations
  3. Online
94
Q

What three things should be submitted by prospective security consultants looking to be hired for a project?

A
  1. Custom application
  2. Resume
  3. Proof of license, in jurisdictions with this requirement
95
Q

How can consultant applications be evaluated?

A
  1. Compate the quality of documents and candidates’ credentials
  2. References from prior clients
  3. Background investigations of top candidates
96
Q

What types of questions should be asked during a consultant interview?

A

Questions that probe the candidate’s security philosophy

97
Q

What subjects should be negotiated with a security consultant prior to hiring?

A
  1. Scope of work
  2. Product to be delivered
  3. Methodology
  4. Timing
  5. Related expenses
98
Q

What are five types of fee structures for consultants?

A
  1. Hourly fees
  2. Daily fees
  3. Fixed fees
  4. Not-to-exceed fees
  5. Retainers
99
Q

When is paying a consultant an hourly fee applicable?

A

When the assignment is expected to last less than a day, but the exact amount of time needed is unclear.

100
Q

When are fixed fee structures used with consultants?

A

When the number of days required to accomplish he work can be estimated accurately and controlled by the consulant.

101
Q

What is a not-to-exceed fee?

A

The consultant’s guarantee that the total cost or time will be limited to the parameters agreed to in the contract.

102
Q

What is a consultant retainer agreement?

A

The consultant agrees to work a specified number of days each year for the client, and the client is guaranteed access to the consultant when needed.

103
Q

What should be covered during a consultant’s organizational orientation?

A
  1. Backgrounds and responsibilities of key personnel
  2. Organizational chart
  3. Operating environment
  4. Key assets and functions
  5. Internal and external relationships relevant to the project
  6. Specific legislative or regulatory control
  7. History of the enterprise
  8. Philosophy of top management
  9. Competitive position
104
Q

What should be outlined in a consultant’s work plan?

A
  1. Scope
  2. Tasks and priorities
  3. Assignments
  4. Completion schedules
105
Q

What should be included in a consultant’s final report?

A
  1. Executive summary
  2. Results achieved
  3. Recommendations
106
Q

How should the recommendations section of the consultant’s final report be structured?

A

The recommendations should be numbered for future reference and should define any additional work that needs to be done, together with suggestions on how to accomplish it.

107
Q

What is a chief security officer?

A

A senior executive level function responsible for providing comprehensive integrated risk strategies to help protect an organization from wide spectrum of threats.

108
Q

What seven categories or skills is required by a chief security officer?

A
  1. Relationship leader
  2. Executive management and leadership
  3. Subject matter expertise
  4. Governance team member
  5. Risk executive
  6. Strategist
  7. Creative problem solver
109
Q

Why is it recommended that the chief security officer report to a key senior-level executive?

A

To ensure a strong liaison with designated leadership bodies.

110
Q

A chief security officer is expected to have what level of education?

A

Advanced education and degrees should be highly valued.

My Certification (14 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions