Section 21 - Risk Assessments Flashcards
What are Risk Assessments?
A process used inside of risk management to identify how much risk exists in a given network or system
In every risk management program, there’s essentially only four things that you can do with risk. What are they?
Avoid
Transfer
Mitigate
Accept
What is Risk Avoidance?
A strategy that requires stopping the activity that has risk or choosing a less risky alternative
What is a Risk Transfer?
A strategy that passes the risk to a third party
What is Risk Mitigation?
A strategy that seeks to minimize the risk to an acceptable level
What is a Risk Acceptance?
A strategy that seeks to accept the current level of risk and the costs associated with it if the risk were realized
What is Residual Risk?
The risk remaining after trying to avoid, transfer, or mitigate the risk
To conduct a risk assessment, you have only to use four steps. What are these?
- Identify assets
- Identify vulnerabilities
- Identify threats
- Identify the impact
During a risk assessment, there are two different ways to measure risk. What are these?
Qualitatively
Quantitatively
What is qualitative analysis?
This uses intuition, experience, and other methods to assign a relative value to risk
The relative categories of high, medium and low are used for this.
*** Since this measure is highly suggestive, those using it should have the proper reflected experience and education of the threat to give this analysis
What is quantitative analysis?
Uses numerical and monetary values to calculate risk
Equations are used to determine the total and residual risk, as well as provide you with a cost directly associated with those risks.
*** This is going to remove much of the estimation and guesswork from a risk assessment because it’s going to turn this into a math problem instead.
What is a magnitude of impact?
This is an estimation of the amount of damage that a negative risk might achieve
This is performed after a qualitative or quantitative risk assessment to see the amount of damage
*** This is also known as a risk of impact
What are the three most common calculations used in determining the magnitude of an impact in a quantitative risk analysis?
Single Loss Expectancy (SLE)
Annualized Rate of Occurrence (ARO)
Annualized Loss Expectancy (ALE)
What is SLE?
Single Loss Expectancy
Cost associated with the realize of each individualized threat that occurs
Asset value x Exposure factor
(Exposure factor means the amount of the asset that’s going to be lost if the threat is realized)
What is ARO?
Annualized Rate of Occurrence
Number of times per year that a threat is realized
What is ALE?
Annual Loss Expectancy
Expected cost of a realized threat over a given year
ALE = SLE x ARO
___ approaches that combine quantitative and qualitative analysis are commonly used
hybrid
** this is often because there’s not enough data to accurately only use a quantitative method
What is a security assessment?
Verify that the organization’s security posture is designed and configured properly to help thwart different types of attacks
There are two types of methodologies when it comes to performing security assessments. What are they?
Active and passive
What is an Active Assessment?
Utilize more intrusive techniques like scanning, hands-on testing, and probing of the network to determine vulnerabilities
What is a Passive Assessment?
Utilize open source information, the passive collection and analysis of the network data, and other unobtrusive methods without making direct contact with the targeted systems
What are security controls?
Methods implemented to mitigate a particular risk
Security controls are broken down into seven types. What are these?
Physical
Technical
Administrative
Preventative
Detective
Corrective
Compensating
What are physical controls?
Any security measures that are designed to deter or prevent unauthorized access to sensitive information or the systems that contain it
