Risk Management

Question 1

Risk Acceptance

Answer 1

• cost of other risk management options like “risk avoidance” may outweigh the cost of the risk itself.

Question 2

Risk Avoidance

Answer 2

• Avoids any exposure to risk.

* Most expensive Risk mitigation option.

Question 3

Risk Limitation

Answer 3

• Used to balance a bit of risk acceptance along with a bit of risk avoidance.

Question 4

Risk Transfer

Answer 4

• Transfer of Risk to a willing third party.

* eg: Insurance company.

Question 5

Mandatory Access Control

Answer 5

• MAC
• Strictest Control
• Primarily used by the Government and military
• Enforces System administer-defined Access Controls to all controlled resources.
• secures information by assigning sensitivity (security level) labels on information.
Eg: Classification - top-Secret, Secret, confidential.

Question 6

Discretionary Access Control

Answer 6

• DAC allows each user to control access to their own data. Eg: file permissions
• Uses an ACL to decide which users or group of users have access to information.
• The owner of information is able to change the ACL permissions at his discretion.

Question 7

Non-Discretionary Access Control

Answer 7

• also known as RBAC - role based access control
• Access is based on users job function within an organization.
• Rules are set by Admin
• Rule-based, Role-based, or both
• Object owner is the organization, not the user.
Eg of RBAC - is allowing an analyst to read logs, but not change configuration.

Question 8

Principle of least Privilege

Answer 8

• The principle of least Privilege states that all users should be granted only the level of privilege they need to do their jobs.
• As needed approach to authorizing access.
• Time based Access
• Authorizes the lowest Privilege required to perform duties.

Question 9

Separation of duties

Answer 9

• An administrative control that dictates that a single individual should not perform all critical or privilege level duties.
• Prevents fraud and error.

Question 10

SIEM

Answer 10

• Security Information And Event Management
• Used by Security analysts to monitor the Enterprise
• It aggregates and correlates various data feeds such as discovery and vulnerability assessment systems, risk and compliance, log management systems, penetration testing tools, Firewalls, IPS, Netflow, threat intelligence feeds, etc in a single pane for analysts.

Question 11

SOC

Answer 11

• Security Operation Center
• Provides detection, containment, and remediation via People, Processes, technology.
• facilities where an organization asset’s, including applications, databases,servers, networks, desktops, and other endpoints are monitored.

Question 12

Threat Centric SOC

Answer 12

• proactively hunts for threats on the network.

* 24/7 hunting via Security data

Question 13

Compliance-Based SOC

Answer 13

• Focuses on the company’s Security as it relates to Compliance

Question 14

Operational-based SOC

Answer 14

• Focuses on maintaining the operational integrity and functionality of the security controls.

Question 15

IT Asset Management

Answer 15

• collecting inventory, financial, and contractual data to manage the IT asset throughout its life cycle.

Question 16

Configuration management

Answer 16

Establishing and maintaining consistency of a products performance, functional requirements, and design throughout the products life cycle.

Question 17

Patch management

Answer 17

Acquiring, testing, and installing of patches or code changes to the IT systems.

Question 18

Vulnerability Management

Answer 18

Identifying, classifying, remediating, and mitigating Vulnerabilities in Software, firmware, and hardware.

Question 19

MDM

Answer 19

Mobile Device Management

• monitors, manage, and secure employees mobile devices.

Question 20

COBIT

Answer 20

• Good practice framework
• COBIT Provides controls over information technology and organizes them around a logical framework of IT-related processes.

Question 21

ISO/IEC 27002:2013

Answer 21

Provide general guidance on the commonly accepted goals of information security management.
• Requirements are identified by a risk assessment
• Combined with COBIT to: Manage IT related Risk, Enforce Network Security Compliance, Fulfill audit Requirements, Satisfy needs for corporate governance and Internal Control.