Lesson 5.1 InfoSec Risk Management Basics

What is Information Security Risk Management?

• The forecasting and evaluation of financial risks together with the identification of procedures to avoid or minimize their impact.

• It allows the organization to assess, identify, and modify its overall security posture.

• It enables security, operations, organizational leadership, and other personnel to collaborate and view the entire organization from an attacker's perspective.

• Both B and C

• Controlling the likelihood and impact of bad things involving information.

What is a "threat"?

• An unpatched system.

• A person or thing likely to cause damage or danger.

• A virus on a device.

• A weakness that results in unwanted attacks.

• Both A and B

What type of incident is a misconfiguration?

• A threat

• A vulnerability

• An exploit

• Both B and C

What is type of incident is phishing?

• A threat

• A vulnerability

• An exploit

• A recreational activity

What is a vulnerability?

• The quality of being vulnerable.

• The quality of state of being exposed to the possibility of being attacked or harmed, physically or emotionally

• A weakness or gap in control.

• All of the above.

Explain Risk.

Answer explanation

The likelihood that a threat will exploit a vulnerability.

True or false. If there isn't a vulnerability, there isn't a risk.

• True

• False

Explain why risk is relative.

Answer explanation

Risk is inevitable. There is no such thing as zero risk and the same is true for infinite risk. Risk lies somewhere in between zero and infinity. It is relative to the environment.

According to NIST Risk Management Framework, how many steps are in the process?

• 4

• 5

• 6

• 7

What are the steps involved in the NIST Risk Management Framework?

• 1. Identify Risk

  2. Assess Risk

  3. Control Risk

  4. Review Controls

• 1. Identify Risks

  2. Measure Risks

  3. Examine Solutions

  4. Implement Solution

  5. Monitor Results

• 1. Categorize Info Systems

  2. Select Security Controls

  3. Implement Security Controls

  4. Assess Security Controls

  5. Authorize Info Systems

  6. Monitor Security Controls

• 1. Identify

  2. Analyze

  3. Evaluate

  4. Prioritize

  5. Treat

  6. Monitor