Security Plus Chapter 15

Front 1

What is the overall purpose of risk analysis?

Back 1

To identify the assets within the company and their value so that the threats against those assets can be identified.

Front 2

What is threat vector?

Back 2

A tool, or mechanism, the hacker uses to exploit a weakness on a system

Front 3

What steps are in the Risk Analysis Process?

Back 3

1. Identify Assets
2. Identity Threats for each Asset
3. Analyze Impact
   

Front 4

Name four types of vulnerabilities to Assets?

Back 4

1. No System Hardening
2. No Physical Security
3. No Security Controls on Data (confidentiality)
   
4. No Administrative Controls (Policies and procedures)
   

Front 5

Name six types of threats to Assets?

Back 5

1. Theft
2. Hacked from inside (critical systems)
   
3. Hacked from outside (public servers)
   
4. Natural Disasters
5. Hardware Failures
6. Fraud
   

Front 6

Name four types of tangible impacts?

Back 6

1. Loss of revenue or business opportunity
2. Loss of money due to cost to fix
3. Loss of production
4. Employee safety
   

Front 7

Name four types of intangible impacts?

Back 7

1. Company reputation
2. Failure to follow regulations
3. Loss of customer confidence
   

Front 8

Once threats have been identified they must be Prioritize base on their?

Back 8

Impact and Probability of occurring so that you can deal with the more serious threats first.

Front 9

Threats are prioritized by what two methods?

Back 9

1. Qualitative analysis: values assigned based on scale i.e. low, medium, or high, based on a scale you create. Risk = Probability x Loss.
2. Quantitative analysis: uses scale developed by someone else. Takes time to calculate>
   

Front 10

After Prioritizing threats the next step is to?

Back 10

Identify mitigation techniques

Front 11

Once solutions to mitigate threats are implemented and the asset has been reevaluated the remaining threats are known as?

Back 11

Residual risk that must be brought to the attention of management so that they can decide if they are willing to accept the risk or implement additional strategies.

Front 12

A Probability Scale is based on?

Back 12

A value created that is based on how the likelihood and impact of an event.

Risk = Probability x Loss

Front 13

What are the two factors involved in Quantitative analysis:

Back 13

1. Single Loss Expectancy (SLE) = Value($) * Exposure Factor (EF)
2. Annual Rate of Occurrence (ARO) = ALE/SLE
   

Front 14

The annual Loss Expectancy = ?

Back 14

SLE * Annual Rate of Occurence (ARO) = (ALE = EF * Value)

Front 15

Name five Risk Mitigation Strategies?

Back 15

1. Mitigate
2. Accept
3. Transfer
4. Avoid
5. Deter the risk
   

Front 16

Risk management methods?

Back 16

1. Enforce technology Security Controls
2. Change Management
3. Incident Management
4. User rights and permissions reviews
5. Perform routine audits
6. Enforce policies and procedures
   

Front 17

Calculating ALE

Back 17

TO calculate the ALE:1. Find SLE = Dollar value x Exposure Factor 320 x .18 = 572. Take SLE and multiply it by the ARO fails once every 4 years 25% so .25 x 57 = 14