Flashcards
Risk Management
Cards in this deck (14)
- 1Typical values to describe risks quantitatively"–Single Loss Occurrence (SLO)
–Annual Loss Expectancy (ALE)" - 2Risks relevant for ICT systems"• Organisational deficiencies
• Force majeure, act of nature
• Technical failure
• Human failure / mistakes
• Deliberate attacks" - 3How can risks be analysed?"–Qualitatively including the IT-Grundschutz-approach
–Quantitatively" - 4Qualitative Risk Analysis [ Advantages ]"–Easy to understand, demonstrative
–Economic values of measures can well be qualitatively discussed" - 5Qualitative Risk Analysis [ Disadvantages ]"–Reproducibility?
–Quality of the results heavily depends on the experience of people involved in the risk assessment" - 6Quantitative Risk AnalysisRisk = (Single occurrence loss) x (likeliness of occurrence)
- 7Information from Service Management (ITIL)MTBSI = MTTR + MTBF
- 8Quantitative Risk Analysis [ Advantages ]"–Results are well comparable (but not necessarily more reliable or correct)
–Method well established in the financial sector" - 9Quantitative Risk Analysis [ Disadvantages ]"- Not necessarily reliable or correct
–How to deal with non-monetary risks (what are the costs for reputation?)
–Likeliness of occurrence in many cases difficult to assess" - 10IT-Grundschutz levelSecurity level that is sufficient and cost effective for average organisations.
- 11IT-Grundschutz Method [Baseline Protection methodology]"–Risk assessment approach is included in ISO 27005
–Management model and certification scheme is based on ISO 27001
–Measures comply with ISO 27002
–Qualification of auditors is based on ISO 27006" - 12Where to find Risk-Catalogues"•Risks from the baseline security catalogues
•Overview from surveys (mostly costly)
•Surveys from public institutions (e.g. by the German Federal Office for Information Security – annual security status report)
•CERT-Messages for vulnerabilities" - 13Where to find standard Security Measures?"•Baseline Protection Catalogues
•ISO/IEC 27002:2007
•CobiT
" - 14Framworks for Risk Analysis"•Failure Impact Analysis ( FIA )
•Attack Tree Analysis ( ATA )
•Privacy Impact Assessment ( PIA )
•OCTAVE
•RoSI"
Information
- Description
- Flashcards on Risk Management, created by faizan.sg on 20/03/2016.
- Created by
- faizan.sg
- Views
- 0
- Rating