Risk Mitigation Flashcards
Risk Identification Process
Frame
Assess
Respond
Respond
The comprehensive process of evaluating, measuring, and mitigating the many
risks that pervade an organization
The comprehensive process of evaluating, measuring, and mitigating the many
risks that pervade an organization
Establish a strategic risk management
framework that is supported by
decision makers at the top tier of the
organization
Frame
Identify and prioritize business
processes/workflow
Assess
Mitigate each risk factor through the deployment of managerial, operational, and
technical security controls
Respond
Evaluate the effectiveness of risk response measures and identify changes that
could affect risk management processes
Monitor
Most business assets have a specific value associated with them
In security terms, assets are valued according to the cost created by their loss or damage
Conducting an Assessment
A loss associated with no longer being able to fulfill contracts and
orders due to the breakdown of critical systems
Business Continuity Loss
A loss created by organizational liability due to prosecution (criminal
law) or damages (civil law)
Legal Costs
A loss created by negative publicity and the consequential loss of
market position or consumer trust
Reputational Harm
The systematic identification of critical systems by compiling an
inventory of the business processes and the tangible and intangible
assets and resources that support those processes
System Assessments
A business or organizational activity that is too critical to be deferred for anything
more than a few hours (if at all)
Mission Essential Function (MEF)
The use of a software or hardware solution to track and
manage any assets within an organization
Asset/Inventory Tracking
An ongoing process of assessing assets against a set of known
threats and vulnerabilities
Threat and Vulnerability Assessment
Risk Calculation
Risk = Probability x Magnitude
Probability
Probability
The impact of a successful exploit or a risk event
Magnitude
A risk analysis method that is based on assigning concrete values
to factors
Quantitative Method
AV x EF = SLE
Single Loss Expectancy (SLE) only provides the value for a single
occurrence or loss
AV
Asset Value
EF
Exposure Factor
SLE
Single Loss Expectancy
The cost of a given risk on an annual basis based on the single loss
expectancy
Annual Loss Expectancy (ALE)
SLE x ARO = ALE
Annual Loss Expectancy
ARO
Annual Rate of Occurrence
ALE
Annual Loss Expectancy
A risk analysis method that uses opinions and reasoning to measure the likelihood
and impact of risk
Qualitative Method
A risk analysis method that uses a mixture of concrete values with opinions and
reasoning to measure the likelihood and impact of risk
Semi-Quantitative Method
A systematic activity that identifies organizational risks and determines their
effect on ongoing, mission critical operations
Business Impact Analysis
The longest period of time a business can be inoperable without
causing irrevocable business failure
Maximum Tolerable Downtime (MTD
The length of time it takes after an event to resume normal business
operations and activities
Recovery Time Objective (RTO)
The length of time in addition to the RTO of individual systems to
perform reintegration and testing of a restored or upgraded system
following an event
Work Recovery Time (WRT)
The longest period of time that an organization can tolerate lost data
being unrecoverable
Recovery Point Objective (RPO)
A risk response that reduces a risk to fit within an organization’s risk appetite
Risk Mitigation
A risk response that involves ceasing an activity that presents risk
Risk Avoidance
A risk response that involves moving or sharing the responsibility of risk to
another entity
Risk Transference
A risk response that involves determining that a risk is within the organization’s
risk appetite and no countermeasures other than ongoing monitoring will be
needed
Risk Acceptance
Control is required by framework, best practice, or regulation
Security Control Prioritization
Amount of risk a control mitigates
Cost of control
A metric to calculate whether a security control is worth the cost of deploying and
maintaining it
Return on Security Investment (RSOI)
An assessment of the benefit of risk reduction against the increased complexity or
cost in a system design or specification
Engineering Tradeoff
Your job is to explain risk in plain and simple language
Communicating Risk
A type of security control that acts as a substitute for a principal control
Compensating Controls
A formal process that is used to document each case where a function or asset is
noncompliant with written policy and procedural controls
Exception Management
The hostile or attacking team in a penetration test or incident
response exercise
Red Team
The defensive team in a penetration test or incident response
exercise
Blue Team
Staff administering, evaluating, and supervising a penetration
test or incident response exercise
White Team
