Module 6: Risk Management Overview
48 Questions
1 Views

Choose a study mode

Play Quiz
Study Flashcards
Spaced Repetition
Chat to Lesson

Podcast

Play an AI-generated podcast conversation about this lesson

Questions and Answers

What is the purpose of Early Warning Indicators in risk management?

  • To increase the risk exposure
  • To eliminate the risk entirely
  • To keep track of early signs of risks (correct)
  • To delay decision-making

Internal sources of risk can be controlled to a certain extent.

True (A)

What should organizations cultivate to enhance risk management processes?

Supportive culture

The _____ cycle involves evaluating inputs at each step of the risk management process.

<p>Review</p> Signup and view all the answers

Which principle of risk management involves considering the various external factors affecting an organization?

<p>Organizational Context (A)</p> Signup and view all the answers

Match the following principles of risk management to their descriptions:

<p>Organizational Context = Factors affecting an organization Continual Improvement = Enhancing risk management strategies Supportive Culture = A culture of discussing risks Review Cycle = Evaluating inputs continuously</p> Signup and view all the answers

What element of risk management involves brainstorming and enabling discussion?

<p>Supportive culture</p> Signup and view all the answers

The PMBOK contains principles that can enhance risk management processes.

<p>True (A)</p> Signup and view all the answers

What is a primary consideration when making decisions related to information security?

<p>Risk-based approach (C)</p> Signup and view all the answers

Information security policies are detailed procedures that describe specific actions to be taken.

<p>False (B)</p> Signup and view all the answers

What must be determined before writing information security policies?

<p>The overall goal of the policy</p> Signup and view all the answers

The responsibility for conducting the GSI strategy often leads to headaches regarding the right __________ decisions.

<p>investment</p> Signup and view all the answers

Match the investment areas with their corresponding focus:

<p>Hardware = Physical assets protection Software = Program and application security Access = User entry and permissions management People = Human resource security</p> Signup and view all the answers

Which of the following is NOT considered an aspect of information security compliance?

<p>Personal preferences (D)</p> Signup and view all the answers

Information security policies should align with corporate risk management models.

<p>True (A)</p> Signup and view all the answers

What approach should be taken to ensure information security?

<p>Risk-Based Approach</p> Signup and view all the answers

What is the primary purpose of a business continuity plan?

<p>To ensure operations can be maintained during disasters (A)</p> Signup and view all the answers

Senior management should not be involved in the creation of the business continuity plan.

<p>False (B)</p> Signup and view all the answers

What is the first step in developing a business continuity plan?

<p>Identify the scope of the plan</p> Signup and view all the answers

The person responsible for the integrity and security of an asset is called the __________.

<p>owner</p> Signup and view all the answers

Match the following terms with their definitions:

<p>Authorization = Permission to perform certain actions Access = Means to reach and use a resource Business Impact Analysis = Assessment of vulnerabilities and losses Downtime = Period when a function is not operational</p> Signup and view all the answers

What is the primary role of a custodian in a system?

<p>To maintain the security of a system (A)</p> Signup and view all the answers

What should a business continuity plan assess in order to identify vulnerabilities?

<p>Business processes and potential losses (A)</p> Signup and view all the answers

Authentication is the process of granting permissions that are linked to the user's account.

<p>False (B)</p> Signup and view all the answers

Acceptable downtime must be determined for each critical function.

<p>True (A)</p> Signup and view all the answers

What is the term used for a person who simply uses the asset without the ability to change access rights?

<p>End User</p> Signup and view all the answers

What is the definition of 'dependencies' in the context of a business continuity plan?

<p>Dependencies refer to the relationships between various business areas and functions that are interconnected.</p> Signup and view all the answers

Identification is simply entering a user __________.

<p>name</p> Signup and view all the answers

Which of the following is NOT one of the three key elements of security?

<p>Decryption (A)</p> Signup and view all the answers

A supplicant refers to a requester in the context of authentication.

<p>True (A)</p> Signup and view all the answers

Most security is based on one or more of three types of things: something you have, something you know, and something you __________.

<p>are</p> Signup and view all the answers

Match the following roles or terms with their descriptions:

<p>Custodian = Maintains system security End User = Uses the asset without permission changes Authentication = Confirming identity Authorization = Granting account permissions</p> Signup and view all the answers

Which access control model allows the owner to define the security policy?

<p>Mandatory Access Control (MAC) (A)</p> Signup and view all the answers

Role Based Access Control (RBAC) grants access based on individual identities rather than roles.

<p>False (B)</p> Signup and view all the answers

What is the primary function of a packet-filtering firewall?

<p>To examine and filter network packets based on predefined rules.</p> Signup and view all the answers

Discretionary Access Control (DAC) is known as the ______ restrictive model.

<p>least</p> Signup and view all the answers

Which of the following is NOT a type of firewalls classified by their processing type?

<p>Nondiscretionary firewalls (D)</p> Signup and view all the answers

What does Task Based Access Control (TBAC) allow users to do?

<p>Change access levels based on the tasks they are performing.</p> Signup and view all the answers

Match the following access control models with their descriptions:

<p>Mandatory Access Control (MAC) = Owner-defined security policy Discretionary Access Control (DAC) = Least restrictive model Role Based Access Control (RBAC) = Access granted based on user roles Task Based Access Control (TBAC) = Access changes based on user tasks</p> Signup and view all the answers

Nondiscretionary controls allow end users to change the security policies.

<p>False (B)</p> Signup and view all the answers

Which layer of the OSI Model is responsible for managing delivery and error checking of data packets?

<p>Transport Layer (C)</p> Signup and view all the answers

A stateful firewall allows packets from any source address without prior connection agreements.

<p>False (B)</p> Signup and view all the answers

What is one common example of a transport layer protocol?

<p>TCP</p> Signup and view all the answers

The _____ layer controls conversations between different computers in the OSI Model.

<p>Session</p> Signup and view all the answers

Match the following types of packet filtering firewalls with their descriptions:

<p>Static = Rules set by a system administrator Dynamic = Rules set by the firewall for itself Stateful = Checks packets based on negotiated connections</p> Signup and view all the answers

The presentation layer is responsible for encrypting and decrypting data.

<p>True (A)</p> Signup and view all the answers

Which protocol is specified for allowing a packet if the source address is 192.168.0.1 and the destination address is 10.10.10.10?

<p>FTP (A)</p> Signup and view all the answers

What is the role of the presentation layer in the OSI model?

<p>Formats or translates data for the application layer</p> Signup and view all the answers

Flashcards

Risk Management Principles

Established guidelines for managing risks, often by organizations or industry bodies.

External Sources

Factors outside a system that impact it and are largely uncontrollable.

Early Warning Indicators

Signals that a risk is escalating into a problem.

Review Cycle

Regular evaluation of the risk management process for improvement.

Signup and view all the flashcards

Supportive Culture

Encouraging an environment that promotes risk discussion and questioning.

Signup and view all the flashcards

Continual Improvement

The ongoing enhancement of risk management strategies.

Signup and view all the flashcards

Organizational Context

The environment (political, social, legal, technological, societal, etc.) affecting an organization.

Signup and view all the flashcards

Problem

A potential threat or adverse situation at work, such as accident or fire.

Signup and view all the flashcards

Risk-Based Approach to Information Security

Information security decisions should be made considering the potential risks.

Signup and view all the flashcards

Risk Management Integration

Information security risk management should be part of the overall corporate risk management process.

Signup and view all the flashcards

Investment Strategy (Info Security)

A plan for investing in information security based on business goals.

Signup and view all the flashcards

Compliance with Laws/Regulations

Information security must adhere to relevant laws and regulations.

Signup and view all the flashcards

Information Security Policy

High-level plan outlining goals and procedures for information security.

Signup and view all the flashcards

Policy Development Steps

Determining what to protect and why, is the first step before creating a security policy.

Signup and view all the flashcards

Protected Asset Categories

Policies can cover various assets like hardware, software, access, people, connections, networks, and telecommunications.

Signup and view all the flashcards

Strategic Investment Decisions

Choosing relevant investments should align with GSI strategy/objectives based on business needs, objectives and expected outcomes.

Signup and view all the flashcards

Business Continuity Plan (BCP)

A plan outlining procedures for maintaining business operations during disasters.

Signup and view all the flashcards

Business Impact Analysis (BIA)

Assessment of business vulnerabilities and potential losses if processes fail.

Signup and view all the flashcards

Key Business Areas

Essential parts of a business that need to operate.

Signup and view all the flashcards

Critical Functions

The essential operations that must continue.

Signup and view all the flashcards

Dependencies

Interconnectivity between different parts of an organization.

Signup and view all the flashcards

Acceptable Downtime

Maximum time an operation can be unavailable without critical impact.

Signup and view all the flashcards

Senior Management Support

Essential involvement of top-level management in BCP creation and updates.

Signup and view all the flashcards

Access Control

Methods for adjusting and controlling who has access to company assets and resources.

Signup and view all the flashcards

Custodian

A person who maintains system security, potentially adding/removing user access.

Signup and view all the flashcards

End User

A person who uses a system's resources without altering access permissions.

Signup and view all the flashcards

Authentication

Verifying a user's identity.

Signup and view all the flashcards

Authorization

Granting permissions based on user accounts.

Signup and view all the flashcards

Subjects

Users or processes representing users interacting with objects.

Signup and view all the flashcards

Objects

System assets (data, files, etc.) acted upon by subjects.

Signup and view all the flashcards

Supplicant/Requester

A user requesting access to a system resource.

Signup and view all the flashcards

Access Control Methods

Ways to restrict system access (e.g., something you have, know, or are).

Signup and view all the flashcards

Mandatory Access Control (MAC)

The most restrictive access control model. Security policies are set by an owner and enforced by a custodian; users cannot change them.

Signup and view all the flashcards

Role Based Access Control (RBAC)

Access is granted based on assigned roles (groups) within the system. Users are associated with roles for their job tasks.

Signup and view all the flashcards

Task Based Access Control (TBAC)

Access control based on the specific task a user is performing; rules can change user access level based on the current task.

Signup and view all the flashcards

Discretionary Access Control (DAC)

Least restrictive model. Users control access to their own resources. Subjects (users) have ownership and decide what other users can access.

Signup and view all the flashcards

Packet-filtering firewall

A firewall that examines network packets to determine if they should be allowed through based on rules like source/destination addresses and protocols.

Signup and view all the flashcards

Network Packet

A small unit of data transmitted over a network. Each packet contains the sender's and receiver's addresses.

Signup and view all the flashcards

Firewall (Classification)

Firewalls can be classified by processing type, generational evolution, or their implemented structure.

Signup and view all the flashcards

Multi-factor authentication

A security process that requires multiple authentication methods (e.g., username/password + one-time password).

Signup and view all the flashcards

Packet Filtering Firewall Types

Packet filtering firewalls use rules to allow or deny packets based on source/destination address, protocol, and other attributes.

Signup and view all the flashcards

Static Firewall

A firewall with rules set by a system administrator.

Signup and view all the flashcards

Dynamic Firewall

A firewall that sets some rules based on observed traffic.

Signup and view all the flashcards

Stateful Firewall

A firewall that tracks connections, preventing packets to suspicious ports unless connected before.

Signup and view all the flashcards

Transport Layer

Manages data packet delivery and error checking, controlling data transfer.

Signup and view all the flashcards

Session Layer

Manages sessions and communication between computers, including authentication and reconnections.

Signup and view all the flashcards

Presentation Layer

Formats and translates data for the application layer, handling syntax and encryption.

Signup and view all the flashcards

OSI Model Layer

A conceptual framework for understanding how network systems communicate with each other.

Signup and view all the flashcards

Study Notes

Module 6: Risk Management

  • Risk management is the process of minimizing or mitigating risk. It involves identifying, evaluating risk, and using resources to monitor and minimize it.
  • Prioritize risks based on potential loss and likelihood of occurrence.
  • Risk management involves four steps: assessment, evaluation/management, and impact measurement.
  • Risk sources can be internal or external. External sources are uncontrollable (e.g., weather), while internal sources are controllable.
  • Various organizations have risk management principles outlined by the International Standardization Organization (ISO) and the Project Management Body of Knowledge (PMBOK). The PMBOK has 10 principles.
  • Risk management considerations include organizational context, stakeholder involvement, organizational objectives, reporting, roles, responsibilities, support structure, early warning indicators, review cycle, and supportive culture.
  • Continual improvement in risk management strategies is key.

Module 7: Information Security Governance

  • Information security governance (GSI) directs and controls information security activities within an organization.
  • Similar to IT Governance, it's an evolving organizational governance structure.
  • Various models exist with different levels of functionality.
  • Policies are high-level plans outlining information security goals.
  • Policies must determine what's being protected and why.
  • Policies cover hardware, software, access, people, connections, network, and telecommunications. Policies also cover enforcement.
  • Security must comply with internal and external laws/regulations, including General Data Protection (GDPR).
  • Security and compliance principles should be consistent with business objectives.
  • Security must promote a positive network environment, as human behaviour is a crucial factor in security.

Studying That Suits You

Use AI to generate personalized quizzes and flashcards to suit your learning preferences.

Quiz Team

Related Documents

IAS Midterm - Reviewer PDF

Description

Explore the essential concepts of risk management in this quiz. Understand the four key steps involved, the distinction between internal and external risk sources, and the guiding principles from ISO and PMBOK. Test your knowledge on prioritizing risks and the considerations necessary for effective management.

More Like This

Risk Management and Assessment in ISO Standards
52 questions

Risk Management and Assessment in ISO Standards

FaultlessDidgeridoo avatar
FaultlessDidgeridoo
ISO 31000 Risk Management Framework
6 questions

ISO 31000 Risk Management Framework

LeanChrysoprase6768 avatar
LeanChrysoprase6768
Risk Management Process according to ISO 31000
33 questions

Risk Management Process according to ISO 31000

RoomierDivisionism avatar
RoomierDivisionism
ISO 27001 Principes
13 questions

ISO 27001 Principes

ReplaceableBanjo avatar
ReplaceableBanjo
Use Quizgecko on...
Browser
Open
Browser
Browser