Risk Management Flashcards
Refers to the protection of personal or organizational information or information resources from unauthorized access, attacks, theft, or data damage.
Cybersecurity
Anything of value that could be compromised, stolen, or harmed, including information, physical resources, and reputation.
Asset
Any event or action that could potentially cause damage to an asset or an interruption of services.
Threat
The intentional act of attempting to bypass one or more security services or controls of an information system.
Attack
A condition that leaves the system and its assets open to harm — including such things as software bugs, insecure passwords, inadequate physical security, and poorly designed networks.
Vulnerability
A technique that takes advantage of a vulnerability to perform an attack.
Exploit
A countermeasure that you put in place to avoid, mitigate, or counteract security risks due to threats or attacks.
Control
Is a measure of your exposure to the chance of damage or loss. Is often associated with the loss of a system, power, or network and other physical losses. Also affects people, practices, and processes.
Risk
Is something or someone that can take advantage of vulnerabilities.
Threat
Is a weakness or deficiency that enables an attacker to violate the integrity of the system.
Vulnerability
Is damage that occurs because the threat took advantage of the vulnerability.
Consequence
Is typically defined as the cyclical process of identifying, assessing, analyzing, and responding to risks.
Risk Management
The comprehensive process of evaluating, measuring, and mitigating the many risks that pervade an organization.
Enterprise Risk Management (ERM)
Is the property that dictates how susceptible an organization is to loss.
Risk Exposure
Is the security process used for assessing risk damages that can affect an organization.
Risk Analysis
Analysis methods use descriptions and words to measure the likelihood and impact of risk. For example, impact ratings can be severe/high, moderate/medium, or low. In a similar manner, likelihood ratings can be likely, unlikely, or rare.
Qualitative
Analysis is based completely on numeric values. Data is analyzed using historical records, experiences, industry best practices and records, statistical theories, testing, and experiments. The goal of this analysis is to calculate the probable loss for every risk.
Quantitative
Analysis method exists because it’s impossible for a purely quantitative risk assessment to exist given that some issues defy numbers. This analysis attempts to find a middle ground between the previous two risk analysis types to create a hybrid method.
Semi-quantitative
Are high-level statements that identifies the organization’s intentions. Are interpreted and made operational through standards, guidelines, and procedures.
Policy/Policies
It consist of specific low-level mandatory controls that help enforce and support policies.
Standards
Are recommended, non-mandatory controls that support standards or that provide a reference for decision making when no applicable standard exists.
Guidelines
Are step-by-step instructions on tasks required to implement various policies, standards, and guidelines.
Procedures
Specifies rules for responding to security incidents before, during, and after they occur.
Incident response policy
Defines a set of rules and restrictions for how various internal and external stakeholders may behave with respect to the organization’s assets.
Acceptable use policy
Outlines the responsibilities that administrators have in keeping various identity data secure and supportive of business objectives. Such policies define expected behavior in how an external or internal user’s identity is created, altered, and deleted with respect to organizational systems.
Account management policy
Often a subset of an account management policy that defines rules for how users generate and maintain account credentials.
Password policy
Outlines how information in the organization is assigned to “owners” — that is, to personnel ultimately responsible for keeping that information secure and accessible by authorized parties only.
Data ownership policy
Outlines how an organization chooses to categorize the different levels of data sensitivity. The organization can triage its security efforts based on what data will bring the most risk if it were leaked or tampered with.
Data classification policy
