Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP CBK > Risk Management > Flashcards

Risk Management Flashcards

1
Q

IRM

A

Information Risk Management - process of identifying and assessing risk, reducing it to an acceptable level, and implementing the right mechanisms to maintain that level

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Risk assessment

A

Method of identifying vulnerabilities and threats and assessing the possible impacts to determine where to implement security controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Cost / benefit Comparison

A

Compares the annualized cost of controls to the potential cost of loss

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Project Sizing

A

Understand what assets and threats should be evaluated

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Loss potential

A

What a company would lose if a threat agent actually exploited a vulnerability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Delayed loss

A

Loss that occurs after the initial vulnerability is exploited

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

NIST SP 800-30

A

Risk Management Guide for Information Technology Systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

FRAP

A

Facilitated Risk Analysis Process - Focus on assessing one system at a time, only the most critical
- Based on experience and risk not quantified for expediency.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

OCTAVE

A

Operationally Critical Threat, Asset, and Vulnerability Evaluation - Carnegie Mellon methodology that allows people within an organization to make security evaluation decisions. Wider scope than FRAP.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

AS/NZS 4360

A

Broad approach to risk management encompassing financial, capital, human safety, and business decision risks. Business, not security, focused.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

ISO/IEC 27005

A

International standard for risk management in ISMS (Information Security Management System)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

FMEA

A

Failure Modes and Effect Analysis - method for determining functions, identifying functional failures, and assessing the causes of failure and their failure effects through a structured process

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Fault tree analysis

A

Method used to identify possible failures that could occur in complex environments and systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

CRAMM

A

Central Computing and Telecommunications Agency Risk Analysis and Management Method - risk analysis and management method developed in the UK and tools sold by Siemens

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Quantitative risk analysis

A

Assign monetary and numeric values to all elements of the risk analysis process

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Qualitative risk analysis

A

Softer approach to the data elements of risk analysis. Does not assign numerical values to risk elements.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

SLE

A

Single Loss Expectancy - dollar amount assigned to a single event that represents the company’s potential loss amount. SLE = Asset value x Exposure factor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Exposure Factor

A

Represents the percentage of loss a threat could have on a certain asset.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

ALE

A

Annual Loss Expectancy

ALE = SLE x Annualized Rate of Occurrence (ARO)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

ARO

A

Annualized Rate of Occurrence

Value that estimates frequency of a specific threat taking place within a 12 month period.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Uncertainty

A

Degree to which you lack confidence in an estimate

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Delphi Technique

A

A group decision method that uses anonymity to obtain a consensus.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Cost / benefit analysis

A

“(ALE before implementing safeguard) – (ALE after implementing safeguard) – (annual cost of safeguard) = value of safeguard to the company”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Residual Risk

A

Amount of risk left over when safeguards / countermeasures are implemented
(threats × vulnerability × asset value) × controls gap = residual risk
total risk – countermeasures = residual risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Total Risk

A

Risk a company faces if it chooses not to implement any safeguards
threats × vulnerability × asset value = total risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Transfer Risk

A

If total risk is too much for a company to deal with they may purchase insurance which transfers the risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Risk Avoidance

A

Remove risk by terminating the activity causing the risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Risk Mitigation

A

Risk reduced to level acceptable enough to continue doing business

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Accept Risk

A

Company understands level of risk and decides to live with it. Cost of countermeasure may outweigh potential loss value.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Security Policy

A

Overall general statement by senior management that dictates role of security within organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Organizational Security Policy

A

Management establishes security program, goals, responsibilities, value, and enforcement.

32
Q

Issue-specific Policy

A

Functional Policy - Addresses specific security issues that need a more detailed explanation and approach

33
Q

System Specific Policy

A

Management’s policy decision regarding specific systems or machines, networks, applications, etc…

34
Q

Regulatory Policy

A

Policy ensures organization is following standards set by specific industry regulations

35
Q

Advisory Policy

A

Strongly advises employees as to which types of behaviors and activities should and should not take place within the organization

36
Q

Informative Policy

A

Informs employees on topics but not enforceable

37
Q

Standards

A

Mandatory activities, actions, or rules

38
Q

Baseline

A

Point in time that used as a comparison for future changes

39
Q

Guidelines

A

Recommended actions and operational guides to users / staff

40
Q

Procedure

A

Detailed step-by-step tasks that should be performed to achieve a certain goal

41
Q

Board of Directors

A

Group of individuals elected by shareholders of a corporation to oversee the fulfillment of the corporation’s charter

42
Q

Chief Executive Officer

A

Responsible for day-to-day management responsibilities of an organization

43
Q

Chief Financial Officer

A

Responsible for a corporation’s account and financial activities and the overall financial structure of the organization

44
Q

Chief Information Officer

A

Responsible for the strategic use and management of information systems and technology within organization

45
Q

Chief Privacy Officer

A

Responsible for ensuring that customer, company, and employee data are kept safe

46
Q

privacy impact analysis

A

Risk assessment from the perspective of protection of sensitive data

47
Q

Chief Security Officer

A

Responsible for understanding the risk a company faces and mitigating these risks to an acceptable level

48
Q

convergence

A

Formal cooperation between previously disjointed security functions

49
Q

security steering committee

A

Group responsible for making decisions on tactical and strategic security issues within the enterprise as a whole

50
Q

audit committee

A

Group appointed by the board of directors reviews and evaluates the company’s internal operations, internal audit system, and transparency and accuracy of financial reporting

51
Q

data owner

A

Usually a member of management who is ultimately responsible for the protection and use of a specific subset of information

52
Q

data custodian

A

responsible for maintaining and protecting the data

53
Q

system owner

A

responsible for one or more systems and the applicable security considerations

54
Q

security administrator

A

responsible for implementing and maintaining specific security network devices and software in the enterprise

55
Q

security analyst

A

works at a higher more strategic level than previous roles and helps develop policies, standards, and guidelines - design level

56
Q

application owner

A

typically business unit manager responsible for deciding access to their application, security, patching, change control

57
Q

change control analyst

A

responsible for approving or rejecting requests to make changes to the network, systems, or software

58
Q

data analyst

A

responsible for ensuring that data is stored in a way that makes the most sense for the company

59
Q

process owner

A

responsible for properly defining, improving upon, and monitoring a company’s business processes

60
Q

solution provider

A

vendor

61
Q

product line manager

A

evaluates different products in the market, works with vendors, understands different options a company can take, advises management on proper solutions needed to meet their goals

62
Q

auditor

A

ensures the organization complies with its own policies and the applicable laws and regulations

63
Q

separation of duties

A

makes sure that one individual cannot complete a critical task by themselves

64
Q

collusion

A

at least two people are working together to cause some type of destruction or fraud

65
Q

split knowledge

A

Type of separation of duty - no one person has the knowledge or the details to complete a task

66
Q

dual control

A

Type of separation of duty

67
Q

rotation of duties

A

rotate employees through a position to detect suspicious activity from the previous employee

68
Q

mandatory vacation

A

force employee to take a vacation to force rotation of duties

69
Q

security governance

A

framework that facilitates security implementation from senior management to communication to implementation to verification of results

70
Q

ISO / IEC 27004:2009

A

International standard used to assess the effectiveness of an ISMS

71
Q

NIST 800-55

A

publication covering performance measuring for information security

72
Q

Organizational tier

A

Risk concerned with the business as a whole

73
Q

Business Process Tier

A

Risk concerned with major functions of the organization

74
Q

Information Systems Tier

A

Risk concerned with information systems

75
Q

Risk Management Process

A

Frame risk, assess risk, respond to risk, monitor risk

76
Q

Threat modeling

A

Describing feasible adverse effects on our assets caused by threat sources

CISSP CBK (4 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions