Risk Management Flashcards
Threat
is a potentially harmful occurrence, such as an earthquake, a power outage, or a network-based worm such as the Conficker worm
Risk =
Threat x vulnerability x impact
A synonym for impact is consequences.
- defined as the likelihood of occurrence of threat and the corresponding loss potential.
- Risk is the probability of a threat agent to exploit vulnerability.
The goal of the Analysis Matrix is
to identify high-likelihood/high-consequence risks.
an example of Qualitative Risk Analysis
Exposure Factor (EF)
is the percentage of value an asset lost due to an incident.
Single Loss Expectancy (SLE) is
SLE = Asset Value x Exposure Factor
Total Cost of Ownership (TCO) is
the total cost of a mitigating safeguard.
combines upfront costs (often a one-time capital expense) plus annual cost of maintenance,
including staff hours, vendor maintenance fees, software subscriptions, etc.
Annualized Loss Expectancy (ALE)
SLE x ARO Cost of losses per tear
Return on Investment (ROI)
is the amount of money saved by implementing a safeguard.
All policy should contain these basic components:
• Purpose - describes the need for the policy, typically to protect the C.I.A.
• Scope - describes what systems, people, facilities, and organizations are covered by the policy.
• Responsibilities - responsibilities of information security staff, policy and management teams, and all members of the organization.
• Compliance - how to judge the effectiveness of the
policies (how well they are working) and what happens when policy is violated (the sanction).
A progressive discipline for employee termination
- Coaching
- Formal discussion
- Verbal warning meeting, with Human Resources attendance (perhaps multiple warnings)
- Written warning meeting, with Human Resources attendance (perhaps multiple warnings)
- Termination
Quantitative is more
objective
qualitative is more
subjective
Which methodology name is the stands for Operationally Critical Threat, Asset, and Vulnerability Evaluation, a risk management framework
OCTAVE
o Phase 1 identifies staff knowledge, assets, and threats.
o Phase 2 identifies vulnerabilities and evaluates safeguards.
o Phase 3 conducts the Risk Analysis and develops the risk mitigation strategy.
What is the name of the methodology which focuses on the standardization and certification of an organization’s information security management system (ISMS).
ISO 27001
Who describes information security best practices (Techniques or code of practices).
ISO27002
Who is an international standard for how Risk Management should be carried out in the framework of an ISMS (Information Security Management standard).
27005
Who is the control framework for employing information security governance best practices and focuses more on operational goals.
COBIT has four domains: Plan and Organize, Acquire and Implement, Deliver and Support, and Monitor and Evaluate.
Control Objectives for Information and related
There are 34 IT processes across these four domains.
COSO framework
Committee of Sponsoring Organizations of the Treadway Commission)
providing leadership with frameworks and guidance on enterprise risk management, internal control and fraud deterrence
It acts as a model for corporate governance and focuses more on strategic goals.
Explores qualitative risk assessment, which makes a base assumption that a slight risk assessment is the most efficient way to determine risk in a system, business segment, application or process.
Facilitated Risk Analysis Process (FRAP)
It allows organizations to prescreen applications, systems, or other subjects to determine if a risk analysis is needed to concentrate on subjects that truly need a formal risk analysis.
A method for determining failures, identifying functional failures and assessing the causes of failure and their effects through structured process.
Failure Mode and Effect Analysis (FMEA)
It helps to determine where exactly failure is most likely to occur.
