Chapter 6 - Managing Risk In Information Systems

Front 1

When describing the system or process, you often focus on what two primary areas?

Back 1

Operational Characteristics and Mission of the System

Front 2

Define operational characterisics

Back 2

how the system operates in your environment, you need to identify how the system is currently configured and operating

Front 3

Define the mission of the system

Back 3

what the system does

Front 4

In reviewing previous findings, what three (3) items are worth investigating?

Back 4

Recommendations
Current status of accpted recommendations
Unapproved recommendations

Front 5

Management structure refers to?

Back 5

how responsibilities are assigned

Front 6

Define Asset Valuation

Back 6

the process of determing the fair market value of an asset, one of the first priorities of risk management

Front 7

Replacement value

Back 7

the/ cost to purchase a new asset in its place

Front 8

Recovery value

Back 8

the cost to get the asset operaional after a failure

Front 9

Elements to consider when determining the value of different assets

Back 9

-system access and system availability
-system functions
-hardware assets
-software assets
-personnel assets
-data and information assets
-facilities and supplies

Front 10

Access and availability

Back 10

refers to how and when the asset needs to be available

Front 11

Whitelist

Back 11

a list of approved e-mail addresses or e-mail domains

Front 12

Blacklist

Back 12

automatically marked as spam

Front 13

Define hardware assets

Back 13

any assets that you can physically touch

Front 14

Define software assets

Back 14

include both the operating system and the applications

Front 15

Define personnel assets

Back 15

personnel that an organization is able to retain often has fewer problems than one witha high turnover rate

Front 16

Define data and information assets

Back 16

different levels of value based on the classification of the data:
-public data: freely available to anyone
-private data: internal data, data on employees and customers
-proprietary data: highly valuable data, deserves a lot of protection, if lost could seriously effect the company's profitability

Front 17

Define facilities and supplies

Back 17

information needed when calculating your insurance needs
-hot site: a location that can take over the operations of another location within a short period
-cold site: a building wth electricity and running water but little else
-warm site: a compromise between a hot site and a cold site, may include all the hardware but the data may not be up to date

Front 18

In identifying and evaluating relevant threats, use what two (2) methods?

Back 18

review historical data and modeling

Front 19

Reviewing historical data, you should look for

Back 19

attacks
natual events
accidents
equipment failures

Front 20

Define threat modeling

Back 20

a process used to identify possbile threats on a system, which provide on:
-the system: background information
-threat profile: list of threats
-threat analysis: to determine if an asset is vulnerable

Front 21

Define vulnerability assessment

Back 21

a process used to discover weakness in a system, with multiple goals such as:
-identify IP address
-Identify names
-identify operating systems
-identify open ports
-identify weak passwords
-capture data

Front 22

Name some common vulnerability assessments tools

Back 22

-Nmap: a network mapping tool that determines open ports
-Nessus: commercial product that can detect common vulnerabilities in the configuration of a system
-SATAN: Security Administrator Tool for Analyzing Networks, not as popular as the other tools
-SAINT: System Administrator's Integrated Network Tool, full suite of vulnerability tools

Front 23

Define exploit assessment

Back 23

attempts to discover what vulnerabilities an attacker can exploit, aka "penetration tests"

Front 24

Define countermeasures

Back 24

a security control or a safeguard

Front 25

Name the Control Categories

Back 25

Administrative security controls, which are the controls in place in response to the rules and guidelines directed by upper-level management
-Technical security control, uses computers or software to protect systems
-Physical security control, which controls the physical environment such as locked doors, guards and access logs, video cameras

Front 26

Name a common mistake needed to implement a control

Back 26

underestimating the costs needed

Front 27

Best practices for performing risk assessments

Back 27

-ensure systems are fully described
-review past audits
-review past risk assessments
-match the RA to the management structure
-identify assets with the RA boundaries
-identify and evaluate relevant threats
-identify and evaluate relevant vulnerabilities
-identify and evaluate countermeasures
-track the results

Front 28

What is used to track and monitor the controls and approved recommendations?

Back 28

POAM: Plan of Actions or Milestones