Risk Management Flashcards
1
Q
Risk Categories (3)
A
Damage
Disclosure
Losses
2
Q
5 Risk Factors
A
Physical Damage
Malfunction
Attacks
Human Error
Application Error
3
Q
Security Policy Development
( 4 Steps)
A
- Security Procedures
- Security Guidelines
- Security Baselines
- Acceptance Use Policy
4
Q
Risk Planning
(In Organizational mgt level / number of years)
A
Strategic 5 yr
Tactical 1 yr
Operating MQ
5
Q
Response to Risk (6)
A
Acceptance
Mitigation
Assignment
Avoidance
Deterrence
Rejection
6
Q
Primary Risk Management Framework
A
NIST 800-37
7
Q
NIST 800-37 Steps
A
- Prepare
- Categorize
- Security Control
- Implement Security Control
- Assess the Controls
- Authorize the system
- Monitor Security Control
8
Q
Types of Risk (3)
A
Residual
Inherent
Total
9
Q
Total Risk
Formula
A
Threats * Vulnerabilities * Asset Value
10
Q
Risk
Formula
A
Threat * Vulnerability
11
Q
Methodology of Risk Assessment - Examples such as NIST….,
A
NIST SP 800-30
OCTAVE
FRAP
FMEA
Fault Tree Analysis
12
Q
Risk Analysis Approach (2)
A
Quantitative Risk Analysis
Qualitative Risk Analysis
13
Q
Risk Management Process (4) Steps
(FARM)
A
Frame Risk
Assess Risk
Respond to Risk
Monitor
14
Q
Information Exhibits Vulnerabilities ( Data x 3)
A
Data at rest
Data in transit
Data in use
15
Q
TOC/TOU
A
Time-of-check to Time-of-use
16
Q
The Delphi Technique
A
Used in Qualitative Risk Analysis
Individual opinions taken in rounds
17
Q
Residual Risk
A
(Threats * vulnerability * asset value) * control gap
Residual risk = Total Risk - Countermeasures
18
Q
Value of safeguard to the organization
(Control Selection)
Formula
A
(ALE before implementing the safeguard) - (ALE after implementing the safeguard) - (Annual Cost of Safeguard)
19
Q
NIST SP 800-39
(Holistic Risk Management)
A
Managing Information Security Risk
Define 3 Tiers to Risk:
Tier 1 - Organization View
Tier 2 - Mission/ Business Process view
Tier 3 - Information system view
20
Q
Risk Analysis 4 Main Goals
A
- Identify assets and their value to the organization
- Determine the likelihood that a threat exploits a vulnerability
- Determine the business impact of these potential threats
- Provide an economic balance between the impact of the threat and the cost of the countermeasure
21
Q
Risk Management methodology
NIST SP 800-30
A
-Focus: Computer systems and IT issues.
- Does not cover large organizational threats
- Focus on operational component of an enterprise
22
Q
Risk Management Methodology
OCTAVE
A
- Operationally Critical Threat, Asset, and Vulnerability Evaluation methodology.
- 7 Processes
- Created by Carnegie Mellon University
- People manage and direct the risk evaluation for information security within an organization.
- Idea: People who work here knows and best understand the risks
Facilitated workshops - All systems, apps and processes within an organization
23
Q
Risk Management Methodology
FRAP
A
Facilitated Risk Analysis Process
By Thomas Peltier
Crux of this qualitative method focus only on the system that really need assessment to reduce cost
1 App 1 System at a time
Based on experience not numbers
24
Q
Risk Management Methodology
FMEA
A
- Failure Modes and Effect Analysis
- (Block diagrams)
- Function identifying functional failures assessing the cause of failure
- And the cause of the failure through structured process
- Mainly used in product development and operational environments
- Identifying single point of failure
- 5-steps
25
Risk Management Methodology
Fault Tree Analysis
Accessing the Failure in most complex systems
26
Quantitative Risk Analysis
Single Loss Expectancy (SLE) -Definition
SLE is a monetary value is assigned to single event that represents the organization’s potential loss amount
27
Quantitative Risk Analysis
Annualized Loss Expectancy (ALE)
Annual effective amount that an organization should spend
28
Quantitative Risk Analysis
Exposure Factor (EF)
Exposure Factor represents the percentage of a loss a realized threat could have on a certain asset
29
Quantitative Risk Analysis
Annualized Rate of Occurrence (ARO)
ARO is a value represents the estimated frequency of a specific threat taking place within 12- month timeframe
30
Quantitative Risk Analysis
SLE (Single Loss Expectancy) Formula
Asset Value x Exposure Factor (EF) = Single Loss Expectancy
31
Quantitative Risk Analysis
ALE (Annualized Loss Expectancy) Formula
SLE x Annualized Rate of Occurrence (ARO) = ALE
32
Three main categories of control
Administrative
Technical
Physical
33
Administrative Control commonly Referred
Soft Controls
34
Technical Control also called as
Logical Control
35
Examples of Administrative Controls
Security Documentation
Risk management
Personnel Security
And Training
36
Examples of Technical Controls
Software or
Hardware Components
(Firewalls, IDS, and identification and authentication mechanisms)
37
Examples of Physical Controls
Security Guards
Locks
Fencing
Lightning
38
Defence-in-depth
Which is the coordinated use of multiple security controls in a layered approach
39
(6) Different types of Security Controls
Preventative
Detective
Corrective
Deterrent
Recovery
Compensating
40
Preventative Control Type
(Definition)
Intended to avoid an incident from occurring
41
Detective Control Type
(Definition)
Helps identify an incident’s activities and potentially an intruder
42
Corrective Control Type
(Definition)
Fixes components or systems after an incident has occurred
43
Deterrent Control Type
(Definition)
Intended to discourage a potential attacker
44
Recovery Control Type
(Definition)
Intended to bring the environment back to regular operations
45
Compensating Control Type
(Definition)
Provides an alternative measure of control
46
Preventative: Administrative
Policies and procedures
Effective hiring practices
Pre-employment background checks
Controlled termination processes
Data classification and labeling
Security awareness
47
Preventative:Physical
Badges, Swipe cards
Guard, dogs
Fences, locks, mantraps
48
Preventative:Technical
Examples
Passwords, biometrics, smart cards
Encryption, secure protocols, call-back systems, database views, constrained user interfaces
Administrative software, access control lists, firewalls, IPS
49
What is a Control Assessment?
A Control Assessment is an evaluation of one or more controls to determine the extent to which they are:
- implemented correctly,
- operating as intended,
- and producing the desired outcome.
50
Verification vs. Validation
**Verification:** did we implement the control right?
**Validation:** did we implement the right control
51
Risk Monitoring is (3 things)
The ongoing process of
- adding new risks,
- reevaluating existing ones,
- removing moot ones,
- and continuously assessing the effectiveness of our controls at mitigating all risks to tolerable levels.
52
Risk Monitoring should focus on 3 key areas
Effectiveness
Change
Compliance
53
EDR stands for
Endpoint Detection and Response
54
Threat Working Group (TWG)
Part of Risk monitoring
Which consists of members of all major part of organization, meeting regularly to review the list of risks (risk registry)
55
Two (2) major sources of change impact your overall risk:
- Information Systems
- Business
56
Change Advisory Board (CAB) monitors (4)
- Number of unauthorized changes
- Average time to implement a change
- Number of failed changes
- Number of security incidents attributable to changes
57
General Data Protection Regulation (GDPR) came into effect in May 2018
Any organization that stores or processes data belonging to a person from the European Union (EU)
58
Risk Reporting
(3) Target Groups (People)
- Executives (and board members)
- Managers
- Risk owners
59
Typical Risk Maturity Model
Initial
Repeatable
Defined
Managed
Optimizing
60
NIST SP 800 - 161
Supply Chain Risk Management Practices for Federal information systems and Organizations.
61
3 Critical classes of requirements that should be included in a contractual agreement are
- Data Protection - Proactive
- Incident Response - Reactive
- Verification means
62
Suppliers ability to comply with is Contractual obligation.
External Evaluation (Standards like ISO )
- ISO 27001 Certification
- U.S. Department of Defence CyberSecurity maturity model certification (CMMC)
- Payment Card Industry Digital Security Standard (PCI DSS) Certification
- Service Organization Control 1 (SOC1) or 2 (SOC2) report
- U.S. Federal Risk and Authorization Management Program (FedRAMP)
63
CIA Triad
Confidentiality
Integrity
Availability
64
Due Diligence
Can be defined as doing everything within one’s power to prevent a bad thing from happening.
Prior Planning - Actions in Advance (Write Policies, Create Procedures, develop playbooks)
Means that company properly investigated all of its possibly weaknesses and vulnerabilities AKA understanding the threats
65
Due Care
A Prudent person or reasonable person would do.
- Tactically and in the moment
- any reasonable security person would do in the moment
66
Business Continuity (BCP)
Business Continuity is an organization’s ability maintain business functions or quickly resume them in the event that risks are realized and result in disruption.
67
Disaster Recovery (DR) is..
- Disaster Recovery is the process of minimizing the effects of a disaster or major disruption.
- DR is part of BC
68
NIST 800-34
Contingency planning guide for Federal Information Systems
69
BCP and BCM
Business Continuity Planning and Business Continuity Management
70
BCP and BCM Steps
- Continuity Policy
- BIA
- Identify Preventative Controls
- Create Contingency Strategies
- Develop BCP
- Exercise, test, and drill
- Maintain BCP
71
BCM is Critical
Other standards-based organizations
- ISO/IEC 27031:2011
- ISO/IEC 22301:2019
- Business Continuity institute’s Good Practice Guidelines (GPG)
- DRI International Institute’s Professional Practices for BCM
72
BCP Should belong not to ___ but to ___
- Not to BCP Team or its Leader
- but to high-Level Executive Manager, Preferably member of executive board
73
BCP Committee must identify the threats to the organization and map to the following 5 items
- Maximum tolerable downtime and disruption for activities
- Operational disruption and Productivity
- Financial Considerations
- Regulatory Responsibilities
- Reputation
74
Group that developed “Ten Commandments of Computer Ethics”
Computer Ethics Institute
