Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Sec > Risk > Flashcards

Risk Flashcards

1
Q

The lack of the countermeasure or a weakness that is in place

A

vulnerability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Any potential danger that is associated with the exploitation of the vulnerability

A

a threat

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

The likelihood of a threat agent exploiting a vulnerability in the corresponding business impact

A

Risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

An instance of being exposed to loss

A

Exposure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Also known as the countermeasure it is put into place to mitigate or reduce the potential risk

A

a control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Controls are put into place reduce the risk of an organization faces and they come in three main flavors:

A

Administrative, technical and physical controls.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

We know that the different categories of controls to be used are administrative technical and physical.
But what do these controls actually do? The different functionalities of security controls are (6):

A 
Deterrent 
preventative 
corrective 
recovery 
detected 
compensating
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is a group of standards called that serves as industry best practices for the management of security controls in a holistic manner within organizations around the world

A

ISO/IEC 27000 series

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Name 4 examples of enterprise architecture development a.k.a. frameworks

A

Zachman framework, TOGAF, DoDAF, MODAF

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Name two standards under the security controls development

A

CobiT (objectives fir IT Mgmt dev by ISACA & ITGI)

SP 800-53 -NISt

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Name two models for process management

A

Six Sigma, CMMI

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Risk = T * V

A

risk = threat x vulnerability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

SLE = AV * EF

A

single loss expectancy = asset value * exposure factor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

ALE = SLE * ARO

A

Ale $ = SLE $ x ARO %

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

ARO= #/ yr.

A

annualized rate of occurrence.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Delphi Technique

A

anonymous survey to gain uninfluenced responses for consensus. (qualitative analysis)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

CobiT framework.Goal: define controls that should be used to properly manage IT & ensure it maps to business needs. Name the 4 domains:

A

4 Domains:Plan and OrganizeAcquire and ImplementDeliver and Support Monitor and EvaluateIt’s a chklist approach to guide companies when they buy, install, test, certify and accredit IT products

13
Q

which NISt publication outlines controls agencies. need to put into place to be FISMA complaint ?

A

NIST 800-53

14
Q

Name 3 categories if control outlined by NIST:

A

M-O-T

15
Q

COSO is model for corporate governance while CobiT is a model for IT governance. What are the 5 components of COSO:

A

Control EnviroRisk AssessmentControl ActivitiesInfo & CommMonitoring

16
Q

what’s the difference between a risk assessment and a vulnerability assessment

A

Vulnerability assessment find the holes. A risk assessment calculates the probability of the vulnerabilities being exploited and the associated business impact

17
Q

What is Delphi technique

A

Adelphi technique is a group decision method to ensure that each member gets an honest opinion of what here she thinks result of a particular threat will be

18
Q

Residual risk is the risk leftover to deal with after countermeasures have been sent. What is the formula for residual risk?

A

{Threats x vulnerability x asset value = total risk} x control gap = residual risk

19
Q

Total risk is risk a company faces if it is not going to implement any type of safeguard!! what is the formula for total risk

A

Threats x vulnerability x asset value = total risk

20
Q

What are standards

A

Standards referred to mandatory activities actions or rules. They can give a policy it’s support and reinforcement in that direction.

21
Q

What is a baseline

A

The term baseline refers to a point in time that is used as a comparison for future changes.

23
Q

What is a guideline

A

Suggestions and best practices

25
Q

What are procedures

A

Procedures are step-by-step implementation instructions

27
Q

What are the three policy functionality types

A

Regulatory, advisory, informative.

29
Q

What are common levels of sensitivity for a commercial business

A

Confidential,. Private, sensitive, public

31
Q

What are the levels of sensitivity for military purposes

A

Top secret, secrets, confidential, sensitive but unclassified, unclassified

32
Q

It is the users primary responsibility to determine declassification level for information. However who is ultimately responsibile to make sure data is classified and protected

A

mgmt

33
Q

True or false: if different user groups with different security access levels need to access the same info, Management should increase the security controls on the information.

A

True. It is going to be available to a wide range of people so more granular security should be implemented to ensure that only the necessary people access the data

34
Q

True or faults: management should consider the availability integrity and confidentiality when classifying data

A

True

35
Q

Security functionality defines the expected activities of a security mechanism. What does assurance define?

A

Assurance defines the confidence of the security mechanism is providing

36
Q

Review the proper mapping for the ISO/IEC standards:

A

ISO/IEC:27001 = ISMS27002= code of prac for infosec mgmt27003= guideline for isms imp27004=metrics27005= infosec risk mgmt27006=audit & cert

37
Q

What best describes a control to be used in order to carry out fraudulent investigation activities

A

Mandatory vacation is an administrative detective control that allows for an organization to investigate an employees daily business activities to uncover any potential profit maybe taking place

38
Q

What is the relation between COSO and CobiT frameworks

A

Coso deals more at a strategic level, well CobiT focuses more at the operational level. CobiT is a way to meet many of the COSO objectives but only from the IT perspective. COSO deals with non-IT items. It’s main purpose is to help ensure fraudulent financial reporting cannot take place in an organization

39
Q

Looking at risk stds, What’s the difference between NIST 800-30, octave, and AS/NZS 4360?

A

Nist 800 – 30 risk management guide for IT systems is focused on IT risks. Octave is a methodology to set up a risk management program within an organizational structure. AS/NZS takes a much broader approach to risk management, it’s mythology can be used to understand the company’s financial, capital, human safety and business decision risks.

40
Q

Single sign-on tech: what is an application protocol that uses a KDC & tickets and is based on some Symmetric key crypto

A

Kerberos

41
Q

Single sign-on tech: What authentication protocol is simolar to kerberos, uses a PAS and PACs and is based on symmetric and asymmetric Krypto

A

Sesame (Secure European system for applications and a multi vendor environment)

Sec (9 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions