IT Security Management and Risk Assessment

The formal process of maintaining computer security for an organization's assets.

Evaluating risks to assets to determine threats and countermeasures.

Comparing current security measures to established standards (e.g., ISO 27001).

Identifying, evaluating, and controlling risks to organizational assets and operations.

Ensuring the confidentiality, integrity, and availability of organization assets.

Areas where security measures fall short of established standards.

A standard for IT security management systems.

Guidelines established by NIST for IT security.

A less structured approach to identify risks using observations, brainstorming, and expert opinions.

A structured approach to evaluate risks using defined techniques, potentially quantitative or qualitative, to assess risks.

A balanced approach combining elements of different risk analysis methods.

Use when a detailed and long-term strategy for risk management is needed, especially in complex environments with high regulatory requirements.

Useful in early stages of risk identification or in cases where formal approaches are impractical or time-consuming(crisis).

Examples include quantitative (measuring risks in numerical terms) or qualitative (categorizing risks based on impact and likelihood) methods.

Discussing potential threats during a meeting based on team experience or walking through facilities to identify security weaknesses.

To achieve a balance between the depth of a formal analysis and the practicality of an informal approach.

Combining different risk analysis methods (e.g., informal brainstorming, baseline comparisons, formal assessments) to leverage strengths and minimize weaknesses.

When a combined approach is more efficient or better suited to the organization's context, for balanced risk identification without overcommitting to one method.

Measures protecting an organization's physical assets (data centers, buildings, hardware) from unauthorized access, damage, or theft.

Measures discouraging unauthorized access or actions, such as fences and warning signs.

Measures preventing unauthorized access or actions, such as locks and security guards.

Measures detecting unauthorized access or actions, such as alarms and surveillance cameras.

A document outlining security principles, guidelines, and requirements for an organization.

Consider the value of assets, vulnerabilities, and potential threats when developing a security policy.

A program disguised as something harmless, but actually contains malicious code that executes when the user interacts with it.

A standalone program that self-replicates and spreads across networks or devices without requiring user interaction, exploiting system vulnerabilities.

A program that attaches to files or programs, replicating and spreading when those infected files are executed; needs user action to activate.

A type of malware that hides its presence and gives attackers persistent control over a system.

Advanced Persistent Threat – highly sophisticated and targeted attacks aiming to steal sensitive data or disrupt operations over a long period.

One part of a key pair in public-key cryptography; freely shared and used for encrypting data.

The other part of a key pair in public-key cryptography; kept secret and used for decrypting data.

Cryptography using two separate keys (public and private) for encryption and decryption, unlike symmetric encryption which uses a single shared key.

The process of transforming plain text into an unreadable format (ciphertext) using a cryptographic algorithm and a key to protect data from unauthorized access.

A cyberattack that overwhelms a network or server with traffic to prevent legitimate users from accessing it.

A sophisticated DoS attack involving multiple devices working together to amplify the attack's impact. Often uses a botnet, a network of infected computers.

Unauthorized access to sensitive data within a computer system, resulting in the theft or exposure of personal information, financial records, or intellectual property.

An unauthorized entry into a system resulting in the access, theft, or exposure of sensitive data.

Data breaches can lead to legal consequences for the affected organization, including financial penalties and reputational damage.

A user, process, or application that attempts to access a resource. Subjects inherit permissions from the user or application they represent.

A resource that can be accessed, such as a file, directory, program, or even hardware like a processor.

Permissions that define what actions a subject can perform on an object.

The process of verifying a user's identity, often using passwords, biometrics, or other methods.

Granting permissions to access specific resources based on a user's identity and their role.

Access control based on who is requesting access and their granted permissions. Individuals with access can choose to allow others to use the resource.

A review of system records and activities to check if security measures are adequate, rules are followed, and to identify potential issues.

Security measures that regulate who or what can access resources, including processes like authentication, authorization, and auditing.