Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

CISSP CBK > Risk Management > Flashcards

Risk Management Flashcards

(76 cards)

Start Studying
1
Q

IRM

A

Information Risk Management - process of identifying and assessing risk, reducing it to an acceptable level, and implementing the right mechanisms to maintain that level

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Risk assessment

A

Method of identifying vulnerabilities and threats and assessing the possible impacts to determine where to implement security controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Cost / benefit Comparison

A

Compares the annualized cost of controls to the potential cost of loss

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Project Sizing

A

Understand what assets and threats should be evaluated

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Loss potential

A

What a company would lose if a threat agent actually exploited a vulnerability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Delayed loss

A

Loss that occurs after the initial vulnerability is exploited

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

NIST SP 800-30

A

Risk Management Guide for Information Technology Systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

FRAP

A

Facilitated Risk Analysis Process - Focus on assessing one system at a time, only the most critical
- Based on experience and risk not quantified for expediency.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

OCTAVE

A

Operationally Critical Threat, Asset, and Vulnerability Evaluation - Carnegie Mellon methodology that allows people within an organization to make security evaluation decisions. Wider scope than FRAP.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

AS/NZS 4360

A

Broad approach to risk management encompassing financial, capital, human safety, and business decision risks. Business, not security, focused.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

ISO/IEC 27005

A

International standard for risk management in ISMS (Information Security Management System)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

FMEA

A

Failure Modes and Effect Analysis - method for determining functions, identifying functional failures, and assessing the causes of failure and their failure effects through a structured process

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Fault tree analysis

A

Method used to identify possible failures that could occur in complex environments and systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

CRAMM

A

Central Computing and Telecommunications Agency Risk Analysis and Management Method - risk analysis and management method developed in the UK and tools sold by Siemens

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Quantitative risk analysis

A

Assign monetary and numeric values to all elements of the risk analysis process

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Qualitative risk analysis

A

Softer approach to the data elements of risk analysis. Does not assign numerical values to risk elements.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

SLE

A

Single Loss Expectancy - dollar amount assigned to a single event that represents the company’s potential loss amount. SLE = Asset value x Exposure factor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Exposure Factor

A

Represents the percentage of loss a threat could have on a certain asset.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

ALE

A

Annual Loss Expectancy

ALE = SLE x Annualized Rate of Occurrence (ARO)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

ARO

A

Annualized Rate of Occurrence

Value that estimates frequency of a specific threat taking place within a 12 month period.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Uncertainty

A

Degree to which you lack confidence in an estimate

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Delphi Technique

A

A group decision method that uses anonymity to obtain a consensus.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Cost / benefit analysis

A

“(ALE before implementing safeguard) – (ALE after implementing safeguard) – (annual cost of safeguard) = value of safeguard to the company”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Residual Risk

A

Amount of risk left over when safeguards / countermeasures are implemented
(threats × vulnerability × asset value) × controls gap = residual risk
total risk – countermeasures = residual risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Total Risk
Risk a company faces if it chooses not to implement any safeguards threats × vulnerability × asset value = total risk
26
Transfer Risk
If total risk is too much for a company to deal with they may purchase insurance which transfers the risk
27
Risk Avoidance
Remove risk by terminating the activity causing the risk
28
Risk Mitigation
Risk reduced to level acceptable enough to continue doing business
29
Accept Risk
Company understands level of risk and decides to live with it. Cost of countermeasure may outweigh potential loss value.
30
Security Policy
Overall general statement by senior management that dictates role of security within organization
31
Organizational Security Policy
Management establishes security program, goals, responsibilities, value, and enforcement.
32
Issue-specific Policy
Functional Policy - Addresses specific security issues that need a more detailed explanation and approach
33
System Specific Policy
Management's policy decision regarding specific systems or machines, networks, applications, etc...
34
Regulatory Policy
Policy ensures organization is following standards set by specific industry regulations
35
Advisory Policy
Strongly advises employees as to which types of behaviors and activities should and should not take place within the organization
36
Informative Policy
Informs employees on topics but not enforceable
37
Standards
Mandatory activities, actions, or rules
38
Baseline
Point in time that used as a comparison for future changes
39
Guidelines
Recommended actions and operational guides to users / staff
40
Procedure
Detailed step-by-step tasks that should be performed to achieve a certain goal
41
Board of Directors
Group of individuals elected by shareholders of a corporation to oversee the fulfillment of the corporation's charter
42
Chief Executive Officer
Responsible for day-to-day management responsibilities of an organization
43
Chief Financial Officer
Responsible for a corporation's account and financial activities and the overall financial structure of the organization
44
Chief Information Officer
Responsible for the strategic use and management of information systems and technology within organization
45
Chief Privacy Officer
Responsible for ensuring that customer, company, and employee data are kept safe
46
privacy impact analysis
Risk assessment from the perspective of protection of sensitive data
47
Chief Security Officer
Responsible for understanding the risk a company faces and mitigating these risks to an acceptable level
48
convergence
Formal cooperation between previously disjointed security functions
49
security steering committee
Group responsible for making decisions on tactical and strategic security issues within the enterprise as a whole
50
audit committee
Group appointed by the board of directors reviews and evaluates the company's internal operations, internal audit system, and transparency and accuracy of financial reporting
51
data owner
Usually a member of management who is ultimately responsible for the protection and use of a specific subset of information
52
data custodian
responsible for maintaining and protecting the data
53
system owner
responsible for one or more systems and the applicable security considerations
54
security administrator
responsible for implementing and maintaining specific security network devices and software in the enterprise
55
security analyst
works at a higher more strategic level than previous roles and helps develop policies, standards, and guidelines - design level
56
application owner
typically business unit manager responsible for deciding access to their application, security, patching, change control
57
change control analyst
responsible for approving or rejecting requests to make changes to the network, systems, or software
58
data analyst
responsible for ensuring that data is stored in a way that makes the most sense for the company
59
process owner
responsible for properly defining, improving upon, and monitoring a company's business processes
60
solution provider
vendor
61
product line manager
evaluates different products in the market, works with vendors, understands different options a company can take, advises management on proper solutions needed to meet their goals
62
auditor
ensures the organization complies with its own policies and the applicable laws and regulations
63
separation of duties
makes sure that one individual cannot complete a critical task by themselves
64
collusion
at least two people are working together to cause some type of destruction or fraud
65
split knowledge
Type of separation of duty - no one person has the knowledge or the details to complete a task
66
dual control
Type of separation of duty
67
rotation of duties
rotate employees through a position to detect suspicious activity from the previous employee
68
mandatory vacation
force employee to take a vacation to force rotation of duties
69
security governance
framework that facilitates security implementation from senior management to communication to implementation to verification of results
70
ISO / IEC 27004:2009
International standard used to assess the effectiveness of an ISMS
71
NIST 800-55
publication covering performance measuring for information security
72
Organizational tier
Risk concerned with the business as a whole
73
Business Process Tier
Risk concerned with major functions of the organization
74
Information Systems Tier
Risk concerned with information systems
75
Risk Management Process
Frame risk, assess risk, respond to risk, monitor risk
76
Threat modeling
Describing feasible adverse effects on our assets caused by threat sources

CISSP CBK (4 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions