Current challenges in information security risk management

Who is ultimately responsible for managing information security risks?

• End User

• Information Owner

• Chief Executive Officer

To estimate the level of risk from a particular type of security breach, three factors are considered: threats, vulnerabilities, and impact.

An agent with the potential to CAUSE a security breach. This could be either a person or an environmental condition such as fire would be a(n)

• Threat

• Vulnerability

• Impact

Scoping, identification of threats and compliance, validation of compliance and threats and calculating and reporting are the four steps of risk assessment. Which security risk management methodology has this steps?

• FAIR

• OCTAVE

• ISAMM

• CRAMM

ISF provides an Information Risk Analysis Methodology (IRAM) which focuses mainly on

• The identification of infrastructure vulnerabilities

• The reduction of risk impact, management of threats and counter-measures and legal or regulatory compliance.

• The validation of compliance and threats

• The determination of security requirements

• All the above

Security controls may involve monetary costs, and may place other burdens on the organization – for example, requiring employees to wear ID badges.

• TRUE

• FALSE

Given the following:

a.) The impact of a single laptop being lost or stolen is estimated at RM50,000.

b.) Because of inadequate security controls, it is estimated that three laptops will be lost or stolen per year.What is the annual loss expectancy from lost or stolen laptops?

• RM 200,000

• RM 150,000

• RM 50,000

There are three types of information security threats: external threats, environmental or physical threats, and internal threats.

Intentional destruction of important data by a disgruntled employee is an

• External Threat

• Environmental or Physical Threat

• Internal Threat

Which security risk management methodology was developed in 1985 by the Central Computer and Telecommunication Agency (UK)?

• CRAMM

• FAIR

• ISF

• EBIOS

To estimate the level of risk from a particular type of security breach, three factors are considered: threats, vulnerabilities, and impact.

A weakness or flaw in security that could ALLOW a security breach to occur would be a(n)

• Threat

• Vulnerability

• Impact

Which of the following are ways to improve the efficiency of counter measure?

• Conducting workshop based assessment

• Utilizing professional help from external parties

• Identifying typical pattern or layouts or keywords of security relevant policies