Risk Mangement

Front 1

Risk Assessment

Back 1

1. Identify the risk.

2. Conduct threat assessment

3. Analyze business impact for each threat

4. Determine likelihood of threat doing damage.

5. Prioritize risks by weighing likelihood vs potential impact.

6. Create risk mitigation strategy.

Front 2

Length of time to replace equipment

Back 2

Replacement cost

Front 3

Loss of new business opportunities

Back 3

Revenue or opportunity lost

Front 4

How long to get production line up and running again

Back 4

Production loss

Front 5

Most severe from an ethical perspective

Back 5

Human cost

Front 6

Damn your reputation could be critical if threat is obvious or five profile

Back 6

Reputation

Front 7

Must comply with federal laws and industry regulations

Back 7

Legal consequences

Front 8

Includes SLE, ARO, and ALE values.

Back 8

Qualitative risk assessment values

Front 9

Cost of any single loss

Back 9

Single loss expectancy (SLE)

Front 10

The expected number of times a given loss may occur per year.

Back 10

Annual rate of occurrence (ARO)

Front 11

The expected cost per year from threat (SLE x ARO)

Back 11

Annual loss expectancy (ALE)

Front 12

Avoidance, transference, mitigation, deterrence, acceptance, and residual risk are all called.

Back 12

Risk management

Front 13

Technology controls, policies and procedures, routine audits, incident management, change management are all a part of.

Back 13

Risk Management Techniques

Front 14

Device or system configuration tools, continuous monitoring and alert systems - NIDS, NIPS, network vulnerability scanners, remediation tools, patch management software, automated troubleshooters, and application testers - pin testing

Back 14

Automated Security Tools

Front 15

Conducting a Baseline Review, Determining the attack surface, Reviewing code, Reviewing architecture, and Reviewing Design are...........

Back 15

Vulnerability Assessment Elements

Front 16

The existing intended security configuration and comparing network performance to your Security baseline.

Back 16

Baseline Review

Front 17

The existing intended security configuration and comparing network performance to your Security baseline.

Back 17

Baseline Review

Front 18

All of the software and services installed which can be subject to attack.

network hardening techniques

Back 18

Determining attack surface

Front 19

The existing intended security configuration and comparing network performance to your Security baseline.

Back 19

Baseline Review

Front 20

All of the software and services installed which can be subject to attack.

network hardening techniques

Back 20

Determining attack surface

Front 21

Conduct beta testing before implementing software into your network, and secure application design

Back 21

Reviewing code

Front 22

Multiple name brands, known hardware flaws

Back 22

Reviewing Architecture

Front 23

Technology, technology, design of hard drives, solutions, etc.

Back 23

Reviewing design

Front 24

Intrusive and non-intrusive

Credentialed and non-credentialed

Back 24

Types of vulnerability scans

Front 25

Focuses on monitoring communications and makes minor requests

Back 25

Non-intrusive

Front 26

Uses larger traffic volumes, unusual messages, or attempts to gain permissions

Back 26

Intrusive

Front 27

Uses no special permissions or credentials, acts like an outside visitor

Back 27

Non-credentialed

Front 28

Uses user credentials of the host or network being scanned, has a greater knowledge of the network, less intrusive because you have more rights, and no more.

Back 28

Credentialed

Front 29

The goal is to find missing or misconfigured security controls, open ports, weak passwords or encryption, misconfigured security controls, unsecured data, compromised systems, exploitable vulnerabilities, unpatched systems.

Back 29

Goals of Vulnerability scans

Front 30

Front (Term)

Back 30

Penetration test process

Front 31

Black box, white box, gray box

Back 31

Penetration tests

Front 32

No attack or knowledge of system

Back 32

Black Box

Front 33

Full attacker knowledge of system

Back 33

White box

Front 34

Partial attacker knowledge of system

Back 34

Gray box

Front 35

Fundamentally passive in nature examiners entire system network organization checking for specific list of known vulnerabilities. It may be passive an invisible to security systems, or it may be active and prone to set off alarms but does not mean to compromise assets

Back 35

Vulnerability Scan

Hint 35

Knock on the door

Front 36

A simulated attack designed to prove that an asset can be compromised through knowledge of existing security controls, known attack methods to bypass security and compromise the system. Active and intrusive but more focused, is not likely to uncover vulnerabilities.

Back 36

Penetration test

Hint 36

Using the hammer

Front 37

SAINT and Nessus

OpenVAS

Back 37

Vulnerability Scans

Front 38

Vulnerability Assessments

Back 38

Vulnerability Assessments