Chapter 5 - Managing Risk In Information Systems

Front 1

Define Risk Assessment (RA)

Back 1

A process used to identify and evaluate risks

Hint 1

aka Risk Analysis

Front 2

What are safeguards?

Back 2

-Controls
-May reduce a vulnerability or it may reduce the impact from a threat

Front 3

When should an RA be completed?

Back 3

-When evaluating risk
-When evaluating control
-Periodcially after a c ontrol has been implemented

Front 4

Risk Assessments tend to:

Back 4

-Support decision making
-Evaluate control effectiveness

Front 5

What are the steps involved in the RA?

Back 5

-Identify threats and vulnerabilities
-Identify the likelihood that a risk will occur
-Identify asset values
-Determine the impact of a risk
-Determine the usefulness of a safeguard or control

Front 6

Critical Components of a Risk Assessment

Back 6

-Identify Scope
-Identify Critical Areas
-Identify Team

Front 7

Identify Scope:

Back 7

The scope identifies the boundary of the RA, eliminate scope creep, and helps keep the project on track

Front 8

SPOF

Back 8

Single Point of Failure:
-any single piece of hardware whose failure can take down the Web site

Front 9

Identify Team

Back 9

RA Team personnel should not be the same people who are responsible for correcting deficiencies
-helps avoid a conflict of interest

Front 10

Types of Risk Assessment

Back 10

Quantitative & Qualitative

Front 11

Quantitative Type of RA

Back 11

- uses numbers such as actual dollar values, requires a significant amount of data, does take time to gather and when data is available it becomes a math problem with the use of formulas

Front 12

Single Loss Expectancy (SLE)

Back 12

The total loss expected from a single incident

Front 13

Annual Rate of Occurrence (ARO)

Back 13

The number of times an incident is expected to occur in a year

Front 14

Annual Loss Expectancy (ALE)

Back 14

The expected loss in a year

Front 15

Safeguard Value

Back 15

This is the cost of a control

Front 16

Limitations of a Quantitative RA

Back 16

Accurate data not available and insuring that people use the control as expected

Front 17

Qualitative Type of RA

Back 17

-doesn't assign dollar values, it determines the level of risk based on the probability and impact of a risk

Front 18

Define PROBABILITY in a Qualitative RA

Back 18

-the likelihood that a threat will exploit a vulnerability

Front 19

Define IMPACT in a Qualitative RA

Back 19

-the negative result if a risk occurs
-used to identify the magnitude of a risk
-identified as low, medium, or high

Front 20

Risk Level Formula

Back 20

Risk Level = Probability x Impact

Front 21

What are the two sections of a qualitative analysis?

Back 21

-prioritizing the risk
-evaluating the effectiveness of controls

Front 22

Risk categories in prioritizing the risk

Back 22

DoS Attack
Web defacing
Loss of data from unauthorized access
Loss of Web site data due to hardware failure

Front 23

DoS Attack

Back 23

any denial of service or distribute of service attack that results in an outage

Front 24

Web defacing

Back 24

modification of the Web site by unauthorized parties

Front 25

Loss of data from unauthorized access

Back 25

any loss of confidentialty by an attacker accessing customer data or accessing any internal private data

Front 26

Loss of Web site data due to hardware failure

Back 26

indicates loss of any Web site data to include any data used to show the Web pages to customers or application used to retrieve and foramt the date into Web pages

Front 27

RAID stands for

Back 27

Redundant Array of Independent Disks

Front 28

Benefits of a Qualitative RA

Back 28

-uses the opinions of the experts
-is easy to complete
-uses words and scales that are easy to express and understand

Front 29

Limitations of a Qualitative RA

Back 29

-subjective
-based on expertise of the experts
-no CBA
-no real standards

Front 30

Subjective Limitations of a Qualitative RA

Back 30

the analysis and results are based on opinions more than facts

Front 31

Experts Limitations of a Qualitative RA

Back 31

the value of the assessment is only as valuable as the expertise of the experts

Front 32

No CBA Limitations of a Qualitative RA

Back 32

it does not include a cost-benefit analysis

Front 33

No Real Standards Limitations of a Qualitative RA

Back 33

need to define the scales used in the process as simple as low, medium, and high

Front 34

Quantitative Analysis

Back 34

-objective
-uses numeric values such as dollar amounts
-more time consuming
-requires access to a significant amount of historical data
-data not always easy to obtain
-based on SLE, ARO, and ALE formulas
shows clear losses and saving with dollar values
-data can easily be used in a CBA

Front 35

Qualitative Analysis

Back 35

-subjective
-based on opinions of experts
-can be done quicker at a lower cost than quantitaive analysis
-uses word values such as Low, Medium and High
-requires a definition of scales used in the RA

Front 36

Challenges of a Risk Assessment

Back 36

-using a static process to evalutate a moving target
-availability of data and resoources
-data consistency
-estimating impact effects
-providing results support resource allocation and risk acceptance

Front 37

Best Practices for Risk Management

Back 37

-start with clear goals and a defined scope
-ensure senior managment support
-build a strong RA team
-repeat the RA regularly
-define a methodology to use
-provide a report of clear risks and clear recommendations