Risk And Response Flashcards
Cause and Effect Analysis
Wishbone or Ishikawa Analysis that explores root causes or factors that contribute to positive or negative outcomes.
Fault Tree Analysis
Combination of human and technical failures or events that results in negative outcomes. Top level event.
Sensitivity Analysis
Tornado Diagram that displays Quantitative technique that determines risk factors with the highest impact
KPI
Key Performance Indicator - looking at Performance of OPERATIONAL EFFECTIVENESS.
Must be ATTAINABLE. Anything OUTSIDE THRESHOLD is bad.
KRI
Key Risk Indicator - alerting enterprise when RISK APPROACHES UNACCEPTABLE LEVEL. Part of risk response development.
Lagging - indicating risk after risk event.
Leading - Controls in place to prevent risk event.
Best if balanced between lead and lag.
Think TOLERANCE
KCI
Key Control Indicator - quantify how well a SPECIFIC CONTROL IS WORKING. Before creating, need to determine TOLERANCES. Secondary Indicator to KRI showing control failure.
Total Cost of Ownership
Included in the cost-benefit-analysis because it establishes cost baseline that must be considered.
Substantive Test
A test that evaluates the integrity of data or individual transactions.
Compliance Test
A test that is needed to determine compliance rather than the integrity of data.
System Owner
Specifies the information security controls for the system based on the requirements from the information owner.
Risk Treatment Plan
Covers all risk identified on the Risk Register that exceeds the Risk Tolerance.
Progressive and Regressive Testing
Progressive testing begins with expectations and looks for flaws whereas regressive testing works backwards to determine root causes.
Types of Testing
Stress - Maximum users
Volume- Maximum records
Performance - compares to benchmark of other systems.
Most Important Control
Preventive Controls are the most important controls: 2FA, Firewalls, access lists…
Backward Risk Indicator
Provide insights into risks that have occurred already and enable management to be improved.
Operational Controls
KCIs measure performance. Also called Key Effectiveness Indicators.
System Owner
Selects and documents the security controls.
Senior Management
Determines if risk is acceptable.
Reviews and approves the security plan. Not the System Owner.
Control Monitoring
Best way to confirm if the control is addressing the risk and operating effectively.
