Risk Management Flashcards
Quantitative Risk Analysis
produces a report with concrete risks & dollar costs.
Steps:
- Inventory assets and assign a $ value
- R&D each asset, produce list of possible threats
- Perform threat analysis = ARO
- Derive loss potential per threat = ALE
- R&D countermeasures for each threat
- Perform cost/benefit analysis for each countermeasure. select most appropriate response to each threat.
How is SLE calculated?
SLE = AV * EF
cost of a single realized risk against a specific asset
ALE
Annualized Loss Expectancy
ALE = SLE * ARO
possible yearly cost of all instances of a specific realized threat against a specific asset.
Risk Management Framework
Risk Management Framework
NIST SP 800-37
- Categorize –> information systems and the data processed, stored and transmitted
- Select —> baseline security controls
- Implement –> security controls
- Asses –> security controls
- Authorize –> information systems operation
- Monitor –> security controls in the information system
Risk
Risk = Threat * Vulnerability
DEF: the possibility or likelihood that a threat will exploit a vulnerability to cause harm to an asset.
Risk analysis includes analyzing an environment for risks, evaluating each threat event as to its likelihood of occurring and the cost of the damage it would cause, assessing the cost of various countermeasures for each risk, and creating a cost/benefit report for safeguards to present to upper management.
Total Risk
threat * vulnerability * asset value
Residual Risk
total risk - countermeasures
Vulnerability
A vulnerability is the absence or weakness of a safeguard or countermeasure.
Asset Valuation
the dollar value assigned to an asset based on actual cost and non-monetary expenses.
E.g., cost to develop, maintain, administer, advertise, support, repair etc.
Exposure
being susceptible to asset loss because of a threat = there is the possibility that a vulnerability can or will be exploited by a threat agent or event.
NIST 800-30
9-Step Risk Analysis
- System Characterization
- Threat Identification
- Vulnerability Analysis
- Control Analysis
- Likelihood?
- Impact?
- Risk? (compare 5-6)
- Control Recommendations
- Results Docs
Which of the following represents accidental or intentional exploitations of vulnerabilities?
A. Threat events
B. Risks
C. Threat agents
D. Breaches
A. Threat events
You’ve performed a basic quantitative risk analysis on a specific threat/vulnerability/risk relation. You select a possible countermeasure. When performing the calculations again, which of the following factors will change?
A. Exposure factor
B. Single loss expectancy
C. Asset value
D. Annualized rate of occurrence
D. Annualized rate of occurrence
Primary Risk Management Framework
NIST 800-37
People Can See I Am Always Monitoring
Prepare - execute the RMF Categorize - information systems Select - security controls Implement - security controls Assess - security controls Authorize - information systems Monitor - security controls
What is the countermeasure cost/benefit equation?
A. SLE * ARO
B. EF * AV * ARO
C. (ALE1 – ALE2) – CM cost
D. Total risk + controls gap
To make the determination of whether the safeguard is financially equitable, use the following countermeasure cost/benefit equation: (ALE before countermeasure – ALE after implementing the countermeasure) – annual cost of countermeasure = value of the countermeasure to the company.
(ALE1 – ALE2) – CM cost
