Flashcards
Untitled
Cards in this deck (23)
- 1Risk management:process of identifying and controlling risks facing an organization
- 2Risk identification:process of examining an organization’s current information technology security situation
- 3Risk control:applying controls to reduce risks to an organization’s data and information systems
- 4Communities of interest are responsible for:Evaluating the risk controls
Determining which control options are cost effective for the organization
installing the needed controls
Ensuring that the controls remain effective - 5Components of risk identificationPeople
Procedures
Data
Software
Hardware - 6Iterative process begins with ?identification of assets, including all elements of an organization’s system (people, procedures, data and information, software, hardware, networking)
- 7Important asset attributes?People
Procedures
Data - 8Asset attributes to be considered are?name; IP address; MAC address; element type; serial number; manufacturer name; model/part number; software version; physical or logical location; controlling entity
- 9Management of Classified Data Storage,distribution
portability
destruction of classified data
Clean desk policy
and Dumpster diving - 10how to Identify and Prioritize Threatsevaluate
Which threats present danger to assets?
Which threats represent the most danger to information?
How much would it cost to recover from attack?
Which threat requires greatest expenditure to prevent? - 11Risk AssessmentRisk assessment evaluates the relative risk for each vulnerability
Assigns a risk rating or score to each information asset
The goal at this point: create a method for evaluating the relative risk of each listed vulnerability - 12There are three general categories of controlsPolicies
Programs
Technologies - 13risk control strategy: DefendAccomplished through countering threats, removing asset vulnerabilities, limiting asset access, and adding protective safeguards
- 14risk control strategy: MitigateAttempts to reduce impact of vulnerability exploitation through planning and preparation
- 15risk control strategy: TerminateDirects the organization to avoid those business activities that introduce uncontrollable risks
May seek an alternate mechanism to meet customer needs - 16BenchmarkingAn alternative strategy to the cost benefit analysis and its attempt to place a hard dollar figure on each information asset is to approach risk management from a different angle.
- 17Other Feasibility StudiesOrganizational
Operational
Technical
Political - 18Risk Management Discussion PointsOrganization must define level of risk it can live with
Risk appetite: defines quantity and nature of risk that organizations are willing to accept as trade-offs between perfect security and unlimited accessibility
Residual risk: risk that has not been completely removed, shifted, or planned for - 19when documenting results one has to ?At minimum, each information asset-threat pair should have documented control strategy clearly identifying any remaining residual risk
Another option: document outcome of control strategy for each information asset-vulnerability pair as an action plan
Risk assessment may be documented in a topic-specific report - 20Risk Control Practicescontrols that don’t involve such complex, inexact, and dynamic calculations
balance of controls providing greatest value to as many asset-threat pairs as possible - 21Risk identificationA risk management strategy enables identification, classification, and prioritization of organization’s information assets
- 22Residual risk?risk remaining to the information asset even after the existing control is applied
- 23Qualitative versus Quantitative Risk ControlBest Practices and Benchmarks
Organizational Feasibility, Operational Feasibility, Technical Feasibility, and Political Feasibility
Information
- Description
- Flashcards on Untitled, created by rivo781 on 20/05/2015.
- Created by
- rivo781
- Views
- 3
- Rating