Risk Management Flashcards
What is the definition risk in regards to cybersecurity?
A probability that a threat will be realized
What is a vulnerability in regards to cybersecurity
Weakness in design or implementation of a system
What is a threat in regards to cybersecurity?
A condition that could cause harm, loss, damage or compromise IT systems
where does risk fit in with threat and vulnerability
Risk lives between threat and vulnerability
What is risk avoidance? Give an example….
Stopping the activity that has the risk or choosing an alternative
Example: your office computers run on outdated Windows XP. You either take those computers offline or upgrade to a current (more secure) OS
What is risk transfer? Give an example…
Passing the risk to a third party.
Example: Getting insurance
What is risk mitigation? Give an example…
Seeking to minimize the risk to an acceptable level
Example: Regularly scan and take inventory of your network devices and software. Remove unnecessary or unexpected hardware and software from the network.
What is risk acceptance? Give an example…
Accepting the current level of risk and the costs associated with it
Example: Keeping legacy systems active if they are not connected to sensitive data environments. Allowing employees to connect their own devices to an organization’s networks if traffic from these devices is segmented from sensitive networks.
What is usually the deciding factor in risk acceptance
Cost
What is residual risk ?
What is leftover after avoiding, transferring and mitigating the risk
What are the risk assessment steps?
- Identify assets
- Identify vulnerabilities
- Identify threats
- Identify the impact of the risk
What is qualitative risk?
Using intuition, experience, judgement and other non-numerical and non-monetary methods to assign a relative value to risk
What is the critical factor in qualitative analysis?
Experience since it is highly subjective
What is quantitative risk?
Using numerical and monetary values to calculate risk
What is the magnitude of impact?
An estimate of the amount of damage that a negative risk might achieve
What methods are used in calculating magnitude of impact?
SLE, ARO, ALE
What is SLE? How do you calculate it?
Single Loss Expectancy - cost associated with the realization of each individual threat that occurs.
Asset Value x Exposure Factor = SLE
What is ARO?
Annualized Rate of Occurrence - number of times per year that a threat is realized
What is ALE? How do you calculate it?
Annualized Loss Expectancy - expected cost of a realized threat over a year
ALE = SLE x ARO
What is a security assesment?
A process to verify that an organization’s security posture is designed properly to help thwart different types of attacks
What is an active assessment?
Utilizing more intrusive techniques to determine vulnerabilities such as scans, probing the network, hands on testing
What is a passive assessment?
Utilizing non intrusive techniques such as open source information, passive collection and analysis of network data, identifying open ports etc
What are physical controls?
Controls designed to prevent/deter unauthorized access
What are technical controls?
Controls used to avoid, detect, counteract or minimize security risks to our systems and info
What are administrative controls?
Controls that are focused on changing the behavior of people instead of removing the actual risk
What are the NIST categories of controls?
management, operational and technical
What are management controls?
Controls that are focused on things done by people
What are NIST technical controls?
Logical controls that are put into a system in order to secure it
What are operational controls?
Controls focused on things done by people
What are preventative controls?
Controls that are installed before an event happens
What are detective controls?
Controls that are used during the event to find out whether something happened
What are corrective controls?
Controls that are used after an event occurs
What is external risk?
Risk produced by non human source and beyond human control.
Example: natural disaster, blackout, hackers
What is internal risk?
Risk formed within the organization often forecastable
Example: server crash, disgruntled employees
What are legacy systems?
Old tech, methods or systems that are past their service life and usually not secure due to lack of patching and discovered vulnerabilities
What is multiparty risk?
Risk involving the connection of multiple systems or organizations with each bringing risks
Example: two companies merging systems
What is IP theft?
Business assets and property being stolen
What is a good way to mitigate IP theft
DLP (Data Loss Prevention)
What acronym refers to the maximum tolerable length of time that a computer, system, network or application can be down after a failure or disaster occurs.
RTO - Recovery Time Objective
