Risk Assessments Flashcards
Risk Assessments
A process used inside of risk management to identify how much risk exists in a given network or system
Risk
The probability that a threat will be realized
Vulnerabilities
Weaknesses in the design or implementation of a system
Threat
§ Any condition that could cause harm, loss, damage, or compromise to our information technology systems
§ Threats are external and beyond your control
Risk Avoidance
A strategy that requires stopping the activity that has risk or
choosing a less risky alternative
Risk Transfer
A strategy that passes the risk to a third party
Risk Mitigation
A strategy that seeks to minimize the risk to an acceptable level
Risk Acceptance
A strategy that seeks to accept the current level of risk and the costs associated with it if the risk were realized
Residual Risk
The risk remaining after trying to avoid, transfer, or mitigate the risk
Qualitative Risk Analysis
o Qualitative analysis uses intuition, experience, and other methods to assign a relative value to risk
o Experience is critical in qualitative analysis
Quantitative Risk
o Quantitative analysis uses numerical and monetary values to calculate risk
o Quantitative analysis can calculate a direct cost for each risk
Single Loss Expectancy (SLE)
Cost associated with the realization of each individualized threat that occurs
Asset Value x Exposure Factor
Annualized Rate of Occurrence (ARO)
Number of times per year that a threat is realized
Annualized Loss Expectancy (ALE)
Expected cost of a realized threat over a given year
ALE = SLE x ARO
Security Assessments
§ Verify that the organization’s security posture is designed and configured properly to help thwart different types of attacks
§ Assessments might be required by contracts, regulations, or laws
§ Assessments may be active or passive
Active Security Assessments
Utilize more intrusive techniques like scanning, hands-on testing, and probing of the network to determine vulnerabilities
Passive Assessments
o Utilize open source information, the passive collection and analysis of the network data, and other unobtrusive methods without making direct contact with the targeted systems
o Passive techniques are limited in the amount of detail they find
Security controls are categorized as
Physical Controls
Technical Controls
Administrative Controls
Physical Controls
Any security measures that are designed to deter or prevent unauthorized access to sensitive information or the systems that contain it
Technical Controls
Safeguards and countermeasures used to avoid, detect, counteract, or minimize security risks to our systems and information
Administrative Controls
Focused on changing the behavior of people instead of removing the actual risk involved
NIST Security Controls Categories
Management Controls
Operational Controls
Technical Controls
Management Controls (NIST)
Security controls that are focused on decision-making and the management of risk
Operational Controls (NIST)
Focused on the things done by people
Technical Controls (NIST)
Logical controls that are put into a system to help secure it
Preventative Controls
Security controls that are installed before an event happens and are designed to prevent something from occurring
Detective Controls
Used during the event to find out whether something bad might be happening
Corrective Controls
Used after an event occurs
Compensating Control
§ Used whenever you can’t meet the requirement for a normal control
§ Residual risk not covered by a compensating control is an accepted risk
Types of Risks
External Risk
Internal Risk
Legacy Systems
Multiparty
IP Theft
Software Compliance/Licensing
External Risk
Risks that are produced by a non-human source and are beyond human control
Internal Risk
Risks that are formed within the organization, arise during normal operations, and are often forecastable
Legacy Systems
An old method, technology, computer system, or application program which includes an outdated computer system still in use
Multiparty
A risk that refers to the connection of multiple systems or organizations with each bringing their own inherent risks
IP Theft
Risk associated with business assets and property being stolen from an organization in which economic damage, the loss of a competitive edge, or a slowdown in business growth occurs
Software Compliance/Licensing
Risk associated with a company not being aware of what software or components are installed within its network
