Security+ Exam Chapter 17

Front 1

Enterprise Risk Management Program (ERM)

Back 1

Organizations take a formal approach to risk analysis that begins with identifying risks, continues with determining the severity of each risk, and then results in adopting one or more risk management strategies to address each risk

Front 2

Threats

Back 2

Any possible events that might have an adverse impact on the CIA of our information or information systems

Front 3

Vulnerabilities

Back 3

Weaknesses in our systems or controls that could be exploited

Front 4

Risks

Back 4

Combination of a threat and vulnerability and is the potential damage that could take place if nothing is done to reduce the risk

Front 5

Risk Identification Process

Back 5

Identifying the threats and vulnerabilities that exist in your operating environment

Front 6

External Risks

Back 6

Originate from a source outside the organization. These include cybersecurity adversaries, malicious code, and natural disasters.

Front 7

Internal Risks

Back 7

Originate from within the organization. They include malicious insiders, mistakes made by authorized users, and equipment failures.

Front 8

Multiparty Risks

Back 8

Impact more than one organization. Example is a power outage to an entire city block that affects multiple businesses

Front 9

Legacy Systems

Back 9

Outdated systems often do not receive security updates and cybersecurity professionals must take extraordinary measures to protect them against unpatchable vulnerabilities.

Front 10

Intellectual Property (IP) Theft

Back 10

Occur when a company possesses trade secrets or other proprietary information which, if disclosed, could compromise the organization’s business advantage

Front 11

Software Compliance/Licensing Risks

Back 11

When an organization licenses software from a vendor and intentionally or accidentally runs afoul of usage limitations that expose the customer to financial and legal risk.

Front 12

Risk Calculation

Back 12

Not all risks are created equal and this process allows for prioritizing risks based on several factors.

Front 13

Likelihood of Occurance

Back 13

The probability that the risk will occur. Expressed as a percent change over a specified period of time, like a year.

Front 14

Magnitude of Impact

Back 14

The amount of impact that the risk will have on the organization if it does occur. This is usually expressed as a financial cost.

Front 15

Risk Severity Calculation

Back 15

Risk Severity = Likelihood * Impact

Front 16

Risk Assessment

Back 16

Formalized approach to risk prioritization that allows organizations to conduct their reviews in a structured manner

Front 17

Quantitative Risk Assessment

Back 17

Uses numeric data in the analysis, resulting in assessments that allow the very straightforward prioritization of risks.

Front 18

Qualitative Risk Assessments

Back 18

Use subjective rating scales to evaluate probability and magnitude of risks, allowing the assessment of risks that are difficult to quantify.

Front 19

Risk Management

Back 19

Process of systematically addressing the risks facing an organization. It serves two roles:

- Provides guidance in prioritizing risks so that the risks with the highest probability and magnitude are addressed first.

- Quantitative risk assessments help determine whether the potential impact of a risk justifies the costs incurred by adopting a risk management approach.

Front 20

Risk Mitigation

Back 20

Process of applying security controls to reduce the probability and/or magnitude of a risk. It is the most common risk management strategy.

Front 21

Risk Avoidance

Back 21

Change business practices to completely eliminate the potential that a risk will materialize. This can have a detrimental impact on the business.

Front 22

Risk Transference

Back 22

Shifts some of the impact of a risk from the organization experiencing the risk to another entity. Most common example is purchasing an insurance policy that covers a risk.

Front 23

Cyber Security Insurance

Back 23

This coverage would repay some or all of the cost of recovering operations and may also cover lost revenue during and attack.

Front 24

Risk Acceptance

Back 24

Deliberately choosing to take no other risk management strategy and to simply continue operations as normal in the face of the risk. Warranted if the cost of mitigating a risk is greater than the impact of the risk itself.

Front 25

Inherent Risk

Back 25

Original level of risk that exists before implementing any controls.

Front 26

Residual Risk

Back 26

Risk that remains after an organization implements controls designed to mitigate, avoid, and/or transfer the inherent risk.

Front 27

Risk Appetite

Back 27

Level of risk that an organization is willing to accept as a cost of doing business.

Front 28

Control Risk

Back 28

Risk that arises from the potential that a lack of internal controls within the organization will cause a material misstatement in the organization’s financial reports.

Front 29

Risk Matrix

Back 29

Quickly summarizes risks and allows senior leaders to quickly focus on the most significant risks facing the organization.

Front 30

Disaster Recovery Planning (DRP)

Back 30

Developing plans to recover operations as quickly as possible in the face of a disaster. The goal of these plans is to help the organization recover normal operations as quickly as possible in the wake of a disruption.

Front 31

Disaster

Back 31

Any event that has the potential to disrupt an organization’s business. The occurrence of a disaster triggers the activation of the organization’s disaster recovery plan.

Front 32

Site Risk Assessments

Back 32

Seek to identify and prioritize the risks posed to the facility by a disaster, including both internal and external risks from both environmental and man-made disasters.

Front 33

Business Impact Analysis (BIA)

Back 33

Formal process designed to identify the mission essential functions within an organization and facilitate the identification of the critical systems that support those functions.

Front 34

Mean Time Between Failures (MTBF)

Back 34

Measure of the reliability of a system. The expected amount of time that will elapse between system failures.

Front 35

Mean Time to Repair (MTTR)

Back 35

Average amount of time to restore a system to its normal operating state after a failure.

Front 36

Recovery Time Objective (RTO)

Back 36

Amount of time that the organization can tolerate a system being down before it is repaired.

Front 37

Recover Point Objective (RPO)

Back 37

Amount of data that the organization can tolerate losing during an outage.

Front 38

Single Point of Failure

Back 38

Systems, devices, or other components that, if they fail, would cause an outage.

Front 39

Personally Identifiable Information (PII)

Back 39

Information that uniquely identifies an individual person, including customers, employees, and third parties.

Front 40

Protected Health Information (PHI)

Back 40

Medical records maintained by healthcare providers and other organizations that are subject to the health Insurance Portability and Accountability Act (HIPAA)

Front 41

Financial Information

Back 41

Personal financial records maintained by the organization.

Front 42

Government Information

Back 42

Information about government including classified data

Front 43

Information Classification

Back 43

Organizes data into categories based on the sensitivity of the information and the impact on the organization should the information be inadvertently disclosed.

Front 44

Top Secret

Back 44

Information that requires the highest degree of protection

Front 45

Secret Classification

Back 45

Information that requires a substantial degree of protection.

Front 46

Confidential Classification

Back 46

Information that requires some protection.

Front 47

Unclassified Classification

Back 47

Information that does not meet the standards for classification. Not publicly releasable without authorization.

Front 48

Data Ownership

Back 48

Organization designates specific senior executives as the data owners for different data types. They don’t make all of these decisions in isolation. Data owners delegate some of their responsibilities to others in the organization and also rely on advice from subject matter experts.

Front 49

Data Controllers

Back 49

Entities who determine the reasons for processing personal information and direct the methods of processing that data.

Front 50

Data Stewards

Back 50

Individuals who carry out the intent of the data controller and are delegated responsibility from the controller.

Front 51

Data Custodians

Back 51

Individuals or teams who do not have controller or stewardship responsibility but are responsible for the secure safekeeping of information.

Front 52

Data Processors

Back 52

Service providers that process personal information on behalf of a data controller.

Front 53

Data Minimization

Back 53

Collect the smallest possible amount of information necessary to meet their business requirements.

Front 54

Purpose Limitations

Back 54

Information should be used only for the purpose that it was originally collected and that was consented to by the data subjects.

Front 55

Data Retention

Back 55

Guide the end of the data lifecycle. Data should only be kept for as long as it remains necessary to fulfill the purpose for which it was originally collected.

Reducing the amount of data that you retain is the best or most effective strategy for reducing risk

Front 56

Data De-Identification

Back 56

Removes the ability to link data back to an individual, reducing its sensitivity.

Front 57

Data Obfuscation

Back 57

Transforming data into a format where the original information can’t be retrieved. Hashing, tokenization, and data masking are examples.

Front 58

Hashing

Back 58

Hash functions transform a value in our dataset to a corresponding hash value.

Front 59

Tokenization

Back 59

Replaces sensitive values with a unique identifier using a lookup table. You must keep the lookup table secure though.

Front 60

Data Masking

Back 60

Partially redact sensitive information by replacing some or all of the sensitive fields with blank characters.

Front 61

Rainbow Table Attack

Back 61

The attacker computes the hashes of those candidate values and then checks to see if those hashes exist in your data file.