Cissp- Chapter 1 Security Management Practices

Front 1

Which is the better approach for information assurance posture: top-down or bottom-up?

Back 1

Top-down is where senior management initiates and fosters the company's security objectives. It is more successful than bottom-up.

Front 2

List the four main goals of Risk Analysis.

Back 2

1) Identify assets and their vaulues.
2) Identify threats.
3) Quantify impact of potential risks.
4) Provide an economic balance between the possible impact of the risk and the cost of the countermeasure.

Front 3

Define vulnerability, threat, threat agent, and risk.

Back 3

A weakness in a mechanism that threatens the confidentiality, integrity, or availability of an asset. The threat is that somone will discover the vulnerability. The threat agent is an entity that would find and use the weakness. The risk is the likelihood of the threat agent finding and carrying out an exploit.

Front 4

In a quantitative risk analysis, what is the EF, the SLE, the ARO, and the ALE?

Back 4

EF = Exposure Factor
SLE = Single Loss Expectancy
ARO = Annualized Rate of Occurrence
ALE = Annualized Loss Expectancy

EF X asset value = SLE
SLE X ARO = ALE

Front 5

How does one arrive at the value of the Total Risk?

Back 5

Threats X vulnerability X asset value = Total Risk

Total Risk X countermeasure = Residual Risk

Front 6

Who is responsible for data classification? What are these classifications?

Back 6

Data owners are responsible. Commercial sector uses: Confidential, Private, Sensitive, and Public.
Military uses: Top Secret, Secret, Confidential, Sensitive but Unclassified, Unclassified.