Security Information Test 2

Front 1

Risk = ?

Back 1

Threat * Vulnerability

Front 2

What does threat assessment do?

Back 2

Help reduce the impact of threats

Front 3

What does vulnerability assessment do?

Back 3

Help reduce vulnerabilities

Front 4

What does exploit assessment do?

Back 4

Help validate actual threats and vulnerabilities

Front 5

What are the components of risk assessment?

Back 5

Risk identification, risk analysis, risk prioritization

Front 6

What are the components of risk control?

Back 6

Risk management, risk resolution, risk monitoring

Front 7

What is risk avoidance?

Back 7

Not engaging in certain activities that can incur risk

Front 8

What is risk acceptance?

Back 8

Accepting the risk involved in certain activities and addressing any consequences that result in risk

Front 9

What is risk transfer?

Back 9

Sharing the risk with an outside party

Front 10

What is risk mitigation?

Back 10

Reducing or eliminating the risk by applying controls

Front 11

What do you call a prioritized lists of assets and threats a company may make after identification process?

Back 11

TVA (Threat-Vulnerabilities-Assets) worksheet

Front 12

What is Quantitative assessment?

Back 12

-Supports cost-benefit analysis (CBA)
-Meaning of results may not be clear
-Rigor may suffer with use of subjective determinations

Front 13

What is Qualitative assessment?

Back 13

-Supports higher degree of communication with decision makers
-Prioritization may be difficult with small number of values/categories

-Must clearly define values to prevent confusion

Front 14

What is semi-quantitative assessment?

Back 14

-Hybrid method

-Best and worst of both worlds

Front 15

Compare Quantitative and Qualitative

Back 15

Quantitative Qualitative
Objective Subjective

Monetary Value Word Value

Historical Data Expert Opinions

SLE ARO ALE Probability and impact

Front 16

How do you estimate risk?

Back 16

Risk is likelihood multiplied by consequences (impact) minus the percent of risk mitigated by current controls plus degree of uncertainty percent
R = (L*I) - M% + U%

Front 17

What are the steps of risk assessment?

Back 17

Identify hazards

Decide who may be harmed

Assess the risk and take action

Record finding

Review assessment

Front 18

Model of Risk Management

Back 18

Assess Assets
Define Risks
Analyze Risk
Review Controls <---
Implement Controls
Monitor Effectiveness of controls -->

Front 19

What are some factors that go into planning when creating a security policy within an organization

Back 19

Physical environment
Political and legal environment
Competitive environment
Technological environment

Front 20

What are the precursor documents used to support organizational planning for security policies?

Back 20

The mission statement, the vision statement, the value statement

Front 21

What is the mission statement?

Back 21

declares the business of the organization and its intended areas of operation as well as explains what the organization does and for whom

Front 22

What is the vision statement?

Back 22

expresses where the organization wants to go and should be ambitious

Front 23

What is the value statement?

Back 23

Allows an organization to make its conduct and performance standards clear to its employees and the public with a statement

Front 24

Describe tactical planning

Back 24

Has a short-term focus, usually one to three years, breaks applicable strategic goals into a series of incremental objecsts

Front 25

Describe operational planning

Back 25

Used by managers and employees to organize the ongoing day-to-day performance of task, includes clearly identified coordination activities across department boundaries

Front 26

What is EISP?

Back 26

Enterprise Information Security Policy, Sets strategic direction, scope, and tone fororganization’s security efforts. Assigns responsibilities for various areas ofinformation security. Guides development, implementation, andmanagement requirements of informationsecurity program

Front 27

What is ISSP?

Back 27

Issue-Specific Security Policy, Focuses on development for certain areas that a relevance, concern, and controversy. Provides targeted guidance

Front 28

What is SysSP?

Back 28

System-Specific Security Policy, it is an operational level policy. Created by management to guide the implementation of technology. Applies to technology that affects the critical security characteristics of information

Front 29

What are the layers in the bull's eye model starting with outer most layer

Back 29

Policies, Networks, Systems, Applications

Front 30

What are basic rules for shaping a policy?

Back 30

Should never conflict with law, must be able to stand up in court if challenged, must be properly supported and administered