Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Security+ 601 > Sec+ Chapter 17: Risk Management and Privacy > Flashcards

Sec+ Chapter 17: Risk Management and Privacy Flashcards

1
Q

ERM

A

Enterprise risk management

A formal approach to risk analysis that identifies risks, determines risk severity, and adopts risk management strategies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Threats

A

Any possible event that can adversely impact the CIA of information or info systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Vulnerabilities

A

Weaknesses in a system or control that can be exploited by a threat

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Risks

A

Occurs at the intersection of threat and vulnerability

A threat without corresponding vulnerability and vice versa doesn’t pose a risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Risk ID process

A

Identifies threats and vulnerabilities that exist in your operating environment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

External risks

A

Originate from a source outside an org, like hacker groups or former employees

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Internal risks

A

Originate from within an org, like disgruntled employees or partners with access to your network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Multiparty risks

A

When my data breach involves multiple other entities because our networks are connected together

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Legacy systems

A

Outdated and older systems that don’t receive updates

Must be heavily protected against unpatchable vulnerabilities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

IP theft

A

Intellectual property theft

When a company possesses trade secrets or proprietary info that could compromise a business advantage if disclosed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Software compliance / licensing

A

Too few licenses means your employees can’t do their job

Too many licenses is a waste of money as they sit unused

Understand exactly what your licensing requirements are and that you’re purchasing and managing them properly

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Likelihood of occurrence

A

Probability that a risk will occur

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Magnitude of impact

A

Impact risk will make if it does occur

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Formula for risk severity

A

Risk severity = likelihood of occurrence * magnitude of impact

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Risk assessment

A

A formalized approach to risk prioritization that allows orgs to conduct their reviews in a structured manner

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Quantitative risk assessment

A

Numeric data for straightforward prioritization of risks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Qualitative risk assessment

A

Subjective judgements and categories for risks that are difficult to quantify

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Quantitative risk assessment process

A

1) Determine asset value (AV) of affected asset

2) Determine the likelihood the risk will occur

3) Determine the amount of damage that will occur to the asset if the risk materializes

4) Calculate the single loss expectancy (SLE)

5) Calculate the annualized loss expectancy (ALE)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

ARO

A

Annualized rate of occurrence

The number of times a risk is expected each year

EX: If a risk is expected twice a year ARO = 2.0
EX: Once every hundred years ARO = 0.01

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

EF

A

Exposure factor

The percentage of the asset expected to be damaged

EX: EF of a risk that completely destroys an asset = 100% / half = 50% / etc

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

SLE

A

Single loss expectancy

The amount of financial damage expected each time a risk materializes

SLE = AV * EF

22
Q

ALE

A

Annualized loss expectancy

Amount of damage expected from a risk each year

ALE = SLE * ARO

23
Q

Risk management

A

The process of systematically addressing the risks facing an organization

24
Q

Risk mitigation

A

The process of applying security controls to reduce the probability and/or magnitude of a risk

25
Q

Risk avoidance

A

When you change business practices to completely eliminate the potential that a risk will materialize

26
Q

Risk transference

A

Shifts some of the impact of a risk from the organization experiencing the risk to another entity

27
Q

Risk acceptance

A

Deliberately choosing to take no other risk management strategy, accept the risk, and continue operations as normal in the face of a risk

28
Q

Inherent risk

A

Risk that exists in the absence of any security controls

Impact + likelihood

29
Q

Residual risk

A

The level of risk that exists after implementing controls to mitigate, avoid, or transfer inherent risk

Inherent risk + security control effectiveness

30
Q

Risk appetite

A

The level of risk an org is willing to accept as a cost of doing business

31
Q

DRP

A

Disaster recovery plan

A detailed plan for resuming operations after a disaster

Plan before the disaster to have backups, offsite data replication, cloud alternatives, remote sites, etc

32
Q

BIA

A

Business impact analysis

A formal process to identify the mission critical functions within an org and facilitate the identification of the critical systems that support those functions

33
Q

MTBF

A

Mean time between failures

The expected amount of time that will elapse between outages

34
Q

MTTR

A

Mean time to repair

The average amount of time to restore a system to its normal operating state after a failure

35
Q

RTO

A

Recovery time objective

How long it takes to get back up and running to a particular service level, not always a complete recovery

36
Q

RPO

A

Recovery point objective

The amount of data the org can tolerate losing during an outage

We set an objective to meet a certain set of requirements to get a system up and running to determine how much unavailable is unacceptable

37
Q

Single points of failure

A

Systems, devices, or components that will cause a full outage if it fails

38
Q

Privacy notice

A

A notice that outlines the privacy practices adopted by an org

39
Q

PII

A

Personally identifiable information

Any info that uniquely identifies an individual person

40
Q

PHI

A

Protected health information

Medical records maintained by healthcare providers and protected under HIPAA

41
Q

Financial information

A

Any personal financial records maintained by an org

42
Q

Information classification

A

Programs that organize data into categories based on the sensitivity of the information and the impact on the org should it be inadvertently disclosed

43
Q

Data controller

A

Responsible for the purposes and means by which the data is processed

44
Q

Data steward / custodian

A

Responsible for the accuracy of the data, keeping it private, and the security of the data stored in your systems

They will also identify or set labels associated with data so you know who has access

Keeps track of all data laws and regulations so your org complies with them

Implements security controls for data

45
Q

Data processor

A

Processes data on behalf of the data controller

Often a third party or different group

EX:
Payroll department is data controller, defines payroll amount and timeframe
Payroll company is data processor, they process payroll and store employee information

46
Q

Data minimization

A

Collecting the smallest possible amount of information necessary to meet their business requirements

Information that’s not necessary should be either immediately discard or not collected in the first place

47
Q

Purpose limitation

A

Information should only be used for the purpose it was originally collected for

48
Q

Data retention

A

Determines how long data should be kept

49
Q

De-identification

A

AKA anonymization

The process of removing the ability to link data back to an individual, which reduces its sensitivity

50
Q

Data obfuscation

A

Transforming data into a format where the original information can’t be retrieved

EX: Hashing, tokenization, and Data masking

51
Q

Data owner

A

A person responsible for a certain set of data within an organization

EX: VP sales, and they’re responsible for all customer relationship data

52
Q

DPO

A

Data protection officer

Higher level manager responsible for orgs overall data privacy policies

Defines what the privacy policies are, makes sure processes in place to keep data private, and have procedures for handling data throughout the work day

Security+ 601 (18 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions