Risk Part1

Question 1

General

Answer 1

applies to systems and software over its lifecycle. Our focus is risks relating to software engineering project management, however the scope of ISO16085 is wider as it covers the entire lifecycle of systems and software.

Question 2

Information Security Risk Management - application security

Answer 2

Focus on development of insecure applications as a project management risk. The scope of ISO27034-5 is wider, as for example it encourages the establishment of libraries of reusable application security functions that may be shared both within and between organizations.

Question 3

Risk Management Process

Answer 3

The process includes context establishment, risk assessment, risk treatment, risk acceptance, risk monitoring, and communication. These steps are relevant in various fields, including software engineering and project management.

Question 4

Residual Risk

Answer 4

the portion of risk that remains after implementing controls or countermeasures.

Question 5

Risk Assessment

Answer 5

process of identifying risks to operations, assets, individuals, organizations etc resulting from the operation of a system.

Question 6

Risk Identification

Answer 6

Finding, Recognizing and describing risk (NIST def.)

Question 7

Risk Estimation

Answer 7

Assigning values to the probability and consequences of a risk, enabling the calculation of risk exposure (ISO/IEC27005)

Question 8

Risk Evaluation

Answer 8

Comparing risk analysis results to criteria to determine whether risk is acceptable or tolerable (NIST).

Question 9

Risk Estimation

Answer 9

Involves assigning values to the probability and consequences of a risk. This allows calculation of risk exposure: Risk Exposure (RE) = Risk Probability x Risk Impact.
The units for Risk Exposure and impact may be monetary or other quantifiable measures

Question 10

Mapping of Risks on a Risk Matrix

Answer 10

The values assigned to Risk Probability and Risk Impact are used to plot risks on a risk matrix. This helps to categorize risk based on their severity and likelihood.

Question 11

Listing of Risks in a Risk Register

Answer 11

A risk register contains a list of organizational risks, identified by the following attributes:
- Unique identifier
- Description of the Risk
- Impact in monetary terms
- Probability
- Risk Rating (meaning the RE)
- Risk Owner (Ideally and individual)
- Dates of risk identification
- Actions being taken
- Owner of actions being taken
- Date for completion

Question 12

Risk Appetite

Answer 12

level of risk that an organization will tolerate

Question 13

Risk Acceptance - Governance

Answer 13

the risk is accepted by the information owner, not the CISO. Same in SE Project Management. It is usually the risk owner who decides how to manage risk

Question 14

Risk acceptance can happen because

Answer 14

• It can be temporary, because the organization plans to address the risk in the future
• It can be because the cost of addressing the risk is higher than the cost of risk materialization
• It can be because the risk is below the organization’s risk appetite

Question 15

Qualitative Risk Assessment

Answer 15

• Risk Exposure = Risk Probability x Risk Impact
• Evaluates risk without relying on precise probabilities or values, often comparing similar risks
• Useful for risks that are hard to quantify.

Question 16

Quantitative Risk Assessment

Answer 16

• Converts risk into measurable financial metrics: Risk = probability x impact
• Common Metrics Include:
• Single Loss Expectancy
• Annualized Rate of Occurrence
• Annualized Loss Expectancy

Question 17

Single loss expectancy

Answer 17

Expected financial loss per event, calculated as SLE = Asset Value x Exposure Factor.

Question 18

Annualized rate of occurance

Answer 18

Estimated yearly frequency of threat.

Question 19

Annual Loss Expectancy

Answer 19

Expected annual financial loss. ALE = ARO*SLE.

Question 20

Problems with Quantitative Risk Assessment

Answer 20

• Difficult to assess high-impact and low-probability events
• People are not very good at assessing low probabilities
• Different people will evaluate differently
• Difference of factors of 10 or 100 are common ex. Probability of crash is 1 in 100000
• Large error factors can cause events that are not really high risk to dominate the calculation (overestimate of probability) or events that are high risk to be ignored (underestimation of probability or impact)

Question 21

Comparing Approaches

Answer 21

Qualitative Risk Assessment
- Useful when justifying investment in one control vs another unrelated control.
- Useful when it isn’t possible to obtain reliable data.

Quantitative Risk Assessment
- Useful to support a business case for justifying financial investment.
- Probabilities can be hard to establish accurately
Single Loss Expectancy dependent on having known values