Risk Assessment Terminology Flashcards
Learn these terms and definitions
Agreed-upon principles set forth by a company to govern how the employees of that company may use resources such as computers and internet access.
Acceptable Use Policy / Rules of Behavior
A calculation used to identify risks and calculate the expected loss each year.
Annual Loss Expectancy (ALE)
A calculation of how often a threat will occurrence . For Example; a threat that occurs once every five years has an annualized rate of occurrence of 1/5, or 0.2.
Annualized Rate of Occurrence (ARO)
The assessed value of an item (server, property, and so on) associated with cash glow.
Asset Value (AV)
A study of the possible importance if a disruption to a business’s vital resources were to occur.
Business Impact Analysis (BIA)
An agreement between partners in a business that outlines their responsibilities, obligations, and sharing of profits and losses.
Business Partners Agreement (BPA)
The potential percentage of loss to an asset if a threat is realized.
Exposure Factor (EF)
As defined by NIST (in Publication 800-47), it is “an agreement established between the organizations that own and operate connected IT systems to document the technical requirements of the interconnection. The ISA also supports a Memorandum of Understanding or Agreement (MOU/A) between the organizations.”
Interconnection Security Agreement (ISA)
The maximum period of time that a business process can be down before the survival of the organization is at risk.
Maximum Tolerable Downtime (MTD)
The measurement of the anticipated lifetime of a system or component.
Mean Time Between Failures (MTBF)
The measurement of the average of how long it takes a system or component to fail.
Mean Time To Failure (MTTF)
The measurement of how long it takes to repair a system or component once a failure occurs.
Mean Time To Restore (MTTR)
Most commonly known as a MOU rather than MOA, this is a document between two or more parties defining their respective responsibilities in accomplishing a particular goal or mission, such as securing a system.
Memorandum of Understanding (MOU)/Memorandum of Agreement (MOA)
The point last known good data prior to an outage that is used to recover systems.
Recovery Point Objective (RPO)
The maximum amount of time that a process or service is allowed to be down and the consequences still to be considered acceptable.
Recovery Time Objective (RT0)
A configuration of multiple hard disks used to provide fault tolerance should a disk fail. Different levels of RAID exist.
Redundant Array of Independent Disks (RAID)
The probability that a particular threat will occur, either accidentally or intentionally, leaving a system vulnerable and the impact of this occurring.
Risk
A strategy of dealing with risk in which it is decided the best approach is simply to accept the consequences should the threat happen.
Risk Acceptance
An evaluation of each risk that can be identified. Each risk should be out-lined, described, and evaluated on the likelihood of it occurring.
Risk Analysis
An evaluation of the possibility of a threat or vulnerability existing. An assessment must be performed before any other actions - such as how much to spend on security in terms of dollars and manpower - can be decided.
Risk Assessment
A strategy of dealing with risk in which it is decided that the best approach is to avoid the risk.
Risk Avoidance
The process of calculating the risks that exist in terms of costs, number, frequency, and so forth.
Risk Calculation
A strategy of dealing with risk in which it is decided that the best approach is to lessen the risk.
Risk Deterrence
A strategy of dealing with risk in which it is decided that the best approach is to discourage potential attackers from engaging in the behavior that leads to the risk.
Risk Mitigation
A strategy of dealing with risk in which it is decided that the best approach is to offload some of the risk through insurance, third-party contracts, and/or shared responsibility.
Risk Transference
An agreement that specifies performance requirements for a vendor. This agreement may use mean time before failure (MTBF) and mean time to repair (MTTR) as performance measures in the SLA.
Service-Level Agreement (SLA)
The cost of a single loss when it occurs. This loss can be a critical failure, or it can be the result of an attack.
Single Loss Expectancy (SLE)
A single weakness that is capable of bringing an entire system down.
Single Point of Failure (SPOF)
A flaw or weakness in some part of the system’s security procedures, design, implementation, or internal controls that could expose it to danger (accidental or intentional) and result in a violation of the security policy.
Vulnerability
