Risk Management Assessment Quiz
50 Questions
2 Views

Choose a study mode

Play Quiz
Study Flashcards
Spaced Repetition
Chat to lesson

Podcast

Play an AI-generated podcast conversation about this lesson

Questions and Answers

What does the people layer of cybersecurity involve?

  • Implementation, automation, and reporting
  • CISOs/Security Officers, domain experts, and employee awareness (correct)
  • Spear phishing and ransomware
  • Supply chain, middlemen, and distribution channels

    • What role do CISOs/Security Officers play in cybersecurity?

  • Restoring access to data after a ransomware attack
  • Operating technology and solving cybersecurity issues
  • Strategic and tactical leaders (correct)
  • Implementing technology solutions

    • What is the estimated cost of cybercrime in 2021?

  • $27k
  • $6 trillion (correct)
  • $4,500
  • $500 billion

    • What type of attack involves mass infection of systems and demands payment in exchange for restoring access to data?

    <p>Ransomware</p> Signup and view all the answers

    What method do living-off-the-land attacks use to conduct attacks?

    <p>Trusted system tools</p> Signup and view all the answers

    Which technological weakness allows hackers to exploit it before a fix is available?

    <p>Zero-day vulnerability</p> Signup and view all the answers

    What is the average return per attack for hackers?

    <p>$4,500</p> Signup and view all the answers

    What are some common cybersecurity threats mentioned in the text?

    <p>Spear phishing and ransomware</p> Signup and view all the answers

    Which layer of cybersecurity forms the hygiene layer?

    <p>People layer</p> Signup and view all the answers

    What is the primary focus of domain experts in cybersecurity?

    <p>Operating technology and solving cybersecurity issues</p> Signup and view all the answers

    What do hackers use to influence their target selection?

    <p>Return on investment (ROI)</p> Signup and view all the answers

    What is an ISMS?

    <p>A systematic approach for managing an organization's information security</p> Signup and view all the answers

    What is ISO27002 primarily focused on?

    <p>Implementing security controls</p> Signup and view all the answers

    Which of the following is a pillar of a security strategy?

    <p>Risk management</p> Signup and view all the answers

    What does ISO27001:2017 mainly focus on?

    <p>Leadership and planning</p> Signup and view all the answers

    What is the 'Fog of More' related to in cybersecurity?

    <p>Technical maturity</p> Signup and view all the answers

    What is a threat in the context of cybersecurity?

    <p>A potential cause of an unwanted incident</p> Signup and view all the answers

    What is the main focus of an ISMS?

    <p>Managing information security risk</p> Signup and view all the answers

    What does an ISO27k family of standards mainly include?

    <p>Security controls and risk assessments</p> Signup and view all the answers

    What does developing a cybersecurity strategy involve?

    <p>Defining tailored security strategy and roadmap</p> Signup and view all the answers

    What does Cyber Compliance act as in the context of trade?

    <p>An essential barrier for trade in the context of security trends and security management.</p> Signup and view all the answers

    What are the opportunities presented by cybersecurity?

    <p>Avoidance of direct damage and customer/investor confidence</p> Signup and view all the answers

    Which Implementation Group (IG) is characterized by small to medium-sized organizations with limited IT and cybersecurity expertise?

    <p>IG1</p> Signup and view all the answers

    Which Implementation Group (IG) prioritizes addressing the confidentiality and integrity of sensitive data?

    <p>IG3</p> Signup and view all the answers

    Which Implementation Group (IG) supports multiple departments with varying risk profiles and may have regulatory compliance burdens?

    <p>IG2</p> Signup and view all the answers

    Which Implementation Group (IG) must summarize findings and risks after a maturity assessment using the chosen governance standard?

    <p>IG3</p> Signup and view all the answers

    Which Implementation Group (IG) employs individuals responsible for managing and protecting IT infrastructure?

    <p>IG2</p> Signup and view all the answers

    Which Implementation Group (IG) is concerned about keeping business operational and protecting employee and financial information?

    <p>IG1</p> Signup and view all the answers

    Which Implementation Group (IG) employs security experts specializing in different cybersecurity facets?

    <p>IG3</p> Signup and view all the answers

    Which Implementation Group (IG) aims to thwart general attacks with sub-controls implementable with limited expertise?

    <p>IG1</p> Signup and view all the answers

    What is the definition of risk as per ISO31000 and ISO27001:2017?

    <p>The potential harm or threat to an organization, determined by the impact and likelihood</p> Signup and view all the answers

    What does Risk management for CI/CD servers, such as JIRA and Confluence, involve?

    <p>Assessing and protecting critical information assets</p> Signup and view all the answers

    What are RTOs and RPOs in the context of risk management for assets like Active Directory Servers?

    <p>Recovery Time Objectives and Recovery Point Objectives</p> Signup and view all the answers

    How many controls are outlined in ISO27001:2017 for effective risk management?

    <p>114 controls in 14 clauses and 35 control categories</p> Signup and view all the answers

    What does the NIST Cyber Security Framework (CSF) provide guidelines for?

    <p>Developing a cyber security strategy</p> Signup and view all the answers

    What are the two tracks focused on by the NIST CSF?

    <p>Governance and Technical tracks</p> Signup and view all the answers

    What are the essential components of an effective cyber security strategy according to the NIST CSF?

    <p>Continuous diagnostics and mitigation, automation, and measurements and metrics</p> Signup and view all the answers

    What do ISO27002:2017 and other standards provide additional controls and guidelines for?

    <p>Operational security governance, procedural guidelines, and technical controls</p> Signup and view all the answers

    What does NIST do in relation to cyber security programs?

    <p>Validates cyber security programs and offers certifications for individuals as NIST CSF Practitioners</p> Signup and view all the answers

    What is the purpose of the high-level description of the actions to take to mitigate the risk associated with finding A, B, and C?

    <p>To specify the more detailed actions to take for each high-level risk mitigating action</p> Signup and view all the answers

    How can one set a target maturity over 3 years?

    <p>Based on benchmark figures within the same sector</p> Signup and view all the answers

    What is suggested to be documented for each detailed action to take to mitigate risks?

    <p>Stakeholders, budget estimate, and timing</p> Signup and view all the answers

    What is recommended to gain overall security maturity and make it demonstrable towards interested stakeholders during the 'Repeatable, Scalable & Profitable Growth' phase?

    <p>Adopt security standards (ISO27k, NIST, ...)</p> Signup and view all the answers

    What is the purpose of dividing and conquering the cybersecurity task according to the text?

    <p>To divide the cybersecurity task among multiple persons</p> Signup and view all the answers

    What is part of the essential security & compliance projects in the Ecosystem of partners?

    <p>Continuous vulnerability scanning</p> Signup and view all the answers

    What is recommended to focus on during the 'Product/Market Fit' phase in terms of security objectives?

    Signup and view all the answers

    During which phase should one define basic non-functional requirements, manually threat model, validate security of MVP, and use subsidized security services to minimize costs?

    <p>&quot;Product/Market Fit&quot; phase</p> Signup and view all the answers

    What is suggested as an example deliverable in "HOW TO DEVELOP A PROPER CYBER SECURITY STRATEGY"?

    Signup and view all the answers

    What should be prioritized and detailed over the coming (3) years according to the text?

    Signup and view all the answers

    What is suggested during the 'Repeatable, Scalable & Profitable Growth' phase in terms of security objectives?

    Signup and view all the answers

    Study Notes

    • Risk is defined as the potential harm or threat to an organization, determined by the impact and probability. (ISO31000, ISO27001:2017)
    • Risk management for CI/CD servers, such as JIRA and Confluence, involves assessing and protecting critical information assets.
    • Example assets include Active Directory Servers, with different risk profiles, RTOs (Recovery Time Objectives), and RPOs (Recovery Point Objectives).
    • ISO27001:2017 outlines 114 controls in 14 clauses and 35 control categories for effective risk management, including controls for information security policies, human resource security, and access control.
    • The NIST Cyber Security Framework (CSF) provides guidelines for developing a cyber security strategy, with easy-to-understand categories and maturity levels for risk management.
    • The NIST CSF focuses on options for both the Governance and Technical tracks, including the use of community support networks and prioritized controls for effective cyber defense systems.
    • Continuous diagnostics and mitigation, automation, and measurements and metrics are essential components of an effective cyber security strategy, according to the NIST CSF.
    • ISO27002:2017 and other standards provide additional controls and guidelines for operational security governance, procedural guidelines, and technical controls.
    • NIST validates cyber security programs and offers certifications for individuals as NIST CSF Practitioners.
    • The CIS Controls (V7.1) are recommended for the Technical Track, offering a prioritized set of actions that are community-supported, implementable, scalable, and compliant with industry and government security requirements.
    • The 5 critical tenets of an effective cyber defense system, according to the NIST CSF, include offense informs defense, prioritization, measurements and metrics, and continuous diagnostics and mitigation.

    Studying That Suits You

    Use AI to generate personalized quizzes and flashcards to suit your learning preferences.

    Quiz Team

    Related Documents

    Toreon Presentation: Security Trends & Management PDF

    Description

    Test your knowledge of risk management with this quiz. Evaluate your understanding of ISO31000, ISO27001:2017, CI/CD, servers, JIRA/Confluence, business impact assessment, and more.

    More Like This

    Use Quizgecko on...
    Browser
    Open
    Browser
    Browser