Risk Assessment Process Flashcards
is to enable organization executives to determine an appropriate budget for security and, within that budget, implement security controls to optimize the level of protection
risk assessment
This objective is met by providing an estimate of the potential cost to the organization of security breaches, coupled with an estimation of the likelihood of such breaches.
risk assessment
An item of value to the achievement of organizational mission/business objective.
An .. may be specifically related to information processing, including any data, device, or other components of the environment that support information-related activities that can be used, disclosed, altered, destroyed, and/or stolen, resulting in a loss.
Asset
Any circumstance or event with the potential to adversely impact organizational operations (including mission, functions, image, or reputation), organizational assets, or individuals through an information system via unauthorized access, destruction, disclosure, modification of information, and/or denial of service.
Threat
The magnitude of the potential of a threat event to impose a cost on an organization.
Threat severity
Also referred to as threat capability, the probable level of force that a threat agent can apply against an asset.
As an example, consider an adversary attempting to obtain root privileges on a server. With root privileges, the adversary may able to read, alter, or delete files and may be able to encrypt files for ransomware.
Threat strength
Other word for threat strength
Threat capability
The probably frequency, within a given time frame, that a threat agent will act against an asset.
Threat event frequency
Weakness in an information system, system security procedures, internal controls, or implementation that could be exploited or triggered by a threat source.
Vulnerability
A safeguard or countermeasure prescribed for an information system or an organization designed to protect the confidentiality, integrity, and availability of its information and meet a set of defined security requirements.
Security control
The magnitude of harm that can be expected to result from the consequences of unauthorized disclosure of information, unauthorized modification of information, unauthorized destruction of information, loss of information or information system availability.
Impact
A measure of the extent to which an entity is threatened by a potential circumstance or event
Risk
The magnitude of risks or a combination of risks, expressed in terms of the combination of consequences and their likelihood.
Level of risks.
Also called lost event frequency, the probable frequency, within a given time frame, that a threat agent will inflict harm upon an asset.
Likelihood
