Risk Management Flashcards
Threat Actors
Anyone or anything with the motive and resources to attack another’s IT infrastructure
Examples include: Hackers Hacktivists Script kiddies Insiders Competitors Shadow IT Criminal syndicates State actors (nation states) Advanced persistent threat (APT)
Vulnerability
Weakness in an asset.
Threat
Action that a threat actor can use against a vulnerability to cause harm.
Risk
LIkelihood of a threat actor taking advantage of a vulnerability by using a threat against an IT asset.
Asset
Any part of IT infrastructure that has value
Likelihood
Probability of assets being damaged over time.
CIA Triad
Confidentiality
Integrity
Availability
Exploit
Takes advantage of vulnerabilities
Attack Vectors
Pathways to gain access to restricted systems
What is TTP?
Adversary tactics, techniques, and procedures.
What doe AIS stand for?
Automated Indicator Sharing
What does AIS do?
Exchanges cybersecurity intelligence between entities
What is OSINT?
Stands for open-source intelligence. It refers to publicly available cybersecurity intelligence sources.
What does CVE stand for?
Common vulnerabilities and exposures
What is the dark web or dart net?
An encrypted and anonymized Internet access mechanism allowing access to unindexed content
What is STIX?
A cybersecurity intelligence (CI) sharing format, TAXII is an example which exchanges CI.
What does STIX stand for?
Structured Threat Information eXpression
What does TAXII stand for?
Trusted Automated eXchange of Intelligence Information
What does RMF stand for?
Risk Management Framework
What does an RMF do?
Provides guidance on identifying and managing risk
What are the GDPR, HIPPA, and PCI-DSS designed to do?
These are security regulation standards that are designed to protect sensitive data.
What is the purpose of organization security policies?
They are designed to protect assets.
What are managerial security controls?
Administrative functions, such as background checks
What are operational security controls?
An example is policy reviews
Technical security controls
IT security solutions
What are the security control types? (6)
Physical Detective Corrective Preventive Deterrent Compensating
