CIST 1602 Module 3 Chapters 5 and 6
Uncertainty
An estimate made by the manager using good judgement and experience can account for which factor of risk assessment?
Cost of prevention
Determining the cost of recovery from an attack is one calculation that must be made to identify risk, what is another?
Legal management must develop corporate-wide standards
Each manager in the organization should focus on reducing risk. This is often done within the context of one of the three communities of interest, which includes all but which of the following?
2. Legal assessment for the implementation of the information security program is almost always done by the information security or IT departments.
False
3. Threats from insiders are more likely in a small organization than in a large one.
False
4. The security education, training, and awareness (SETA) program is designed to reduce the occurence of external security attacks.
False
6. The first step in the work breakdown structure (WBS) approach encompasses activities, but not deliverables.
False
8. The work breakdown structure (WBS) can only be prepared with a complex specialized desktop PC application.
False
Having an established risk management program means that an organization's assets are completely protected.
False
MAC addresses are considered a reliable identifier for devices with network interfaces because they are essentially foolproof.
False
The IT community often takes on the leadership role in addressing risk.
False
The information technology management community of interest often takes on the leadership role in addressing risk. __________
False - InfoSec
Risk identification, risk analysis, and risk evaluation are part of a single function known as risk protection. __________
False - assessment
33. Which of the following is true about a company's InfoSec awareness Web site?
# d it should be tested with multiple browsers
False
An asset valuation approach that uses categorical or nonnumeric values rather than absolute numerical measures is known as numberless assessment. ____________
5. On-the-job training can result in substandard work performance while the trainee gets up to speed.
True
7. Planners need to estimate the effort required to complete each task, subtask, or action step.
True
A formal access control methodology used to assign a level of confidentiality to an information asset and thus restrict the number of people who can access it is known as a data categorization scheme. __________
False - classification
6. When operating any kind of organization, a certain amount of debt is always involved. __________
False - risk
49. What are the four areas into which it is recommended to separate the functions of security?
Functions performed by nontechnology business units outside the IT area of management control Functions performed by IT groups outside the InfoSec area of management control Functions performed within the InfoSec department as a customer service to the organization and its external partners Functions performed within the InfoSec department as a compliance enforcement obligation
What strategic role do the InfoSec and IT communities play in risk management? Explain.
InfoSec - Because members of the InfoSec community best understand the threats and attacks that introduce risk, they often take a leadership role in addressing risk. IT - This group must help to build secure systems and ensure their safe operation. For example, IT builds and operates information systems that are mindful of operational risks and have proper controls implemented to reduce risk.
40. A(n) ____________________ is a specific point in the project plan when a task that has a noticeable impact on plan's the progress is complete.
Milestone
Relative value
Once an information asset is identified, categorized, and classified, what must also be assigned to it?
What does it mean to "know the enemy" with respect to risk management?
Once an organization becomes aware of its weaknesses, managers can take up Sun Tzu's second dictum: Know the enemy. This means identifying, examining, and understanding the threats facing the organization's information assets. Managers must be fully prepared to identify those threats that pose risks to the organization and the security of its information assets.
The probability that a specific vulnerability within an organization will be attacked by a threat is known as __________.
b likelihood
Once an information asset is identified, categorized, and classified, what must also be assigned to it?
b relative value
The quantity and nature of risk that organizations are willing to accept as they evaluate the trade-offs between perfect security and unlimited accessibility is known as __________.
b risk appetite
__________ is the risk assessment deliverable that assigns a value to each TVA triple, incorporating likelihood, impact, and possibly a measure of uncertainty.
b risk ranking worksheet
Data classification schemes should categorize information assets based on which of the following?
b sensitivity and security needs
What should the prioritized list of assets and their vulnerabilities and the prioritized list of threats facing the organization be combined to create?
b threats-vulnerabilities-assets worksheet
An approach to combining risk identification, risk analysis, and risk evaluation into a single strategy.
b. risk assessment
19. Which of the following would be responsible for configuring firewalls and IDPSs, implementing security software, and diagnosing and troubleshooting problems?
a Security Technician
16. Which of the following functions needed to implement the information security program evaluates patches used to close software vulnerabilities and acceptance testing of new systems to assure compliance with policy and effectiveness?
a Systems Testing
29. Which of the following is an advantage of the user support group form of training?
a Usually conducted in an informal social setting
The risk assessment deliverable titled __________ serves to rank-order each threat to the organization's information assets according to criteria developed by the organization.
c threat severity weighted table analysis
The state of having limited or imperfect knowledge of a situation, making it less likely that organizations can successfully anticipate future events or outcomes, is known as __________.
c uncertainty
What is defined as specific avenues that threat agents can exploit to attack an information asset?
c vulnerabilities
An asset valuation approach that uses categorical or nonnumeric values rather than absolute numerical measures.
h. qualitative assessment
Remains even after the current control has been applied.
i. residual risk
The recognition, enumeration, and documentation of risks to an organization's information assets is known as risk __________.
identification
Assigns a risk-rating ranked value to each uncontrolled asset-vulnerability pair.
j. risk rating worksheet
Assessing risks includes determining the __________ that vulnerable systems will be attacked by specific threats.
likelihood probability
Risk __________ is the process of discovering and assessing the risks to an organization's operations and determining how those risks can be mitigated.
management
The document designed to regulate organizational efforts related to the identification, assessment, and treatment of risk to information assets is known as the RM __________.
policy
The quantity and nature of risk that organizations are willing to accept.
g. risk appetite
What are the included tasks in the identification of risks?
- Creating an inventory of information assets - Classifying and organizing those assets meaningfully - Assigning a value to each information asset - Identifying threats to the cataloged assets - Pinpointing vulnerable assets by tying specific threats to specific assets
False
A formal access control methodology used to assign a level of confidentiality to an information asset and thus restrict the number of people who can access it is known as a data categorization scheme. ____________
54. What is the purpose of a security awareness program? What advantage does an awareness program have for the InfoSec program?
A security awareness program keeps InfoSec at the forefront of users' minds on a daily basis. Awareness serves to instill a sense of responsibility and purpose in employees who handle and manage information, and it leads employees to care more about their work environment.
48. What are some of the variables that determine how a given organization chooses to construct its InfoSec program?
Among the variables that determine how a given organization chooses to structure its information security (InfoSec) program are organizational culture, size, security personnel budget, and security capital budget.
False
An approach to combining risk identification, risk assessment, and risk appetite into a single strategy. is known as risk protection. ___________
53. What is the role of help desk personnel in the InfoSec team?
An important part of the InfoSec team is the help desk, which enhances the security team's ability to identify potential problems. When a user calls the help desk with a complaint about his or her computer, the network, or an Internet connection, the user's problem may turn out to be related to a bigger problem, such as a hacker, a DoS attack, or a virus. Because help desk technicians perform a specialized role in InfoSec, they need specialized training. These staff members must be prepared to identify and diagnose both traditional technical problems and threats to InfoSec. Their ability to do so may cut precious hours off of an incident response.
Why is threat identification so important in the process of risk management?
Any organization typically faces a wide variety of threats. If you assume that every threat can and will attack every information asset, then the project scope becomes too complex. To make the process less unwieldy, each step in the threat identification and vulnerability identification processes is managed separately and then coordinated at the end. At every step, the manager is called on to exercise good judgment and draw on experience to make the process function smoothly.
relative
As each information asset is identified, categorized, and classified, a ________ value must also be assigned to it.
factor analysis
As part of the risk identification process, listing the assets in order of importance can be achieved by using a weighted ____________________ worksheet.
likelihood
Assessing risks includes determining the ____________________ that vulnerable systems will be attacked by specific threats
51. What are the components of the security program element described as preparing for contingencies and disasters?
Business plan, identify resources, develop scenarios, develop strategies, test and revise plan.
Comprehensive
Classification categories must be mutually exclusive and which of the following?
The degree to which a current control can reduce risk is also subject to calculation error. __________
False - estimation
The recognition, enumeration, and documentation of risks to an organization's information assets is known as risk control. __________
False - identification
The probability that a specific vulnerability within an organization will be the target of an attack is known as risk. ___________
False - likelihood
12. Most information security projects require a trained project developer. _________________________
False - manager
11. In the early stages of planning, the project planner should attempt to specify completion dates only for major employees within the project. _________________________
False - milestones
An evaluation of the threats to information assets, including a determination of their potential to endanger the organization, is known as exploit assessment. __________
False - threat
A prioritized list of assets and threats can be combined with exploit information into a specialized report known as a TVA worksheet. __________
False - vulnerabilities
Some threats can manifest in multiple ways, yielding multiple exploits for an asset-threat pair. __________
False - vulnerabilities
44. ____________________ is a phenomenon in which the project manager spends more time documenting project tasks, collecting performance measurements, recording project task information, and updating project completion forecasts than in accomplishing meaningful project work.
Projectitis
management
Risk ____________ is the process of discovering and assessing the risks to an organization's operations and determining how those risks can be mitigated.
For the purposes of relative risk assessment, how is risk calculated?
Risk equals likelihood of vulnerability occurrence multiplied by value (or impact), minus percentage risk already controlled, plus an element of uncertainty.
50. Which security functions are normally performed by IT groups outside the InfoSec area of management control?
Systems security administration Network security administration Centralized authentication
45. Explain the conflict between the goals and objectives of the CIO and the CISO.
The CIO, as the executive in charge of the organization's technology, manages the efficiency in the processing and accessing of the organization's information. Anything that limits access or slows information processing directly contradicts the CIO's mission. On the other hand, the CISO functions more like an internal auditor, with the information security department examining existing systems to discover information security faults and flaws in technology, software, and employees' activities and processes. At times, these activities may disrupt the processing and accessing of the organization's information.
52. What is the Chief Information Security Office primarily responsible for?
The CISO is primarily responsible for the assessment, management, and implementation of the program that secures the organization's information.
Risk analysis
The identification and assessment of levels of risk in an organization describes which of the following?
False
The information technology management community of interest often takes on the leadership role in addressing risk. ____________
How should the initial inventory be used when classifying and categorizing assets?
The inventory should reflect the sensitivity and security priority assigned to each information asset. A classification scheme should be developed (or reviewed, if already in place) that categorizes these information assets based on their sensitivity and security needs.
Risk assessment estimate factors
The likelihood of the occurrence of a vulnerability multiplied by the value of the information asset minus the percentage of risk mitigated by current controls plus the uncertainty of current knowledge of the vulnerability are each examples of _____.
46. What is the security education, training, and awareness program? Describe how the program aims to enhance security.
The security education, training, and awareness (SETA) program is designed to reduce the occurence of accidental security breaches by members of the organization. The program aims to enhance security in three ways: - By building in-depth knowledge, as needed, to design, implement, or operate security programs for organizations and systems - By developing skills and knowledge so that computer users can perform their jobs while using IT systems more securely - By improving awareness of the need to protect system resources
47. List the steps of the seven-step methodology for implementing training.
The seven-step methodology for implementing training is as follows: Step 1: Identify program scope, goals, and objectives. Step 2: Identify training staff. Step 3: Identify target audiences. Step 4: Motivate management and employees. Step 5: Administer the program. Step 6: Maintain the program. Step 7: Evaluate the program.
Describe the use of an IP address when deciding which attributes to track for each information asset.
This attribute is useful for network devices and servers but rarely applies to software. You can, however, use a relational database and track software instances on specific servers or networking devices. Many larger organizations use the Dynamic Host Configuration Protocol (DHCP) within TCP/IP, which reassigns IP numbers to devices as needed, making the use of IP numbers as part of the asset-identification process very difficult.
1. Small organizations spend more per user on security than medium- and large-sized organizations.
True
10. Each organization has to determine its own project management methodology for IT and information security projects.
True
9. A task or subtask becomes a(n) action step when it can be completed by one individual or skill set and when it includes a single deliverable. _________________________
True
Likelihood is the overall rating of the probability that a specific vulnerability will be exploited or attacked.
True
Small organizations spend more per user on security than medium- and large-sized organizations.
True
Some threats can manifest in multiple ways, yielding multiple vulnerabilities for an asset-threat pair.
True
Calculating the severity of risks to which assets are exposed in their current setting
Two of the activities involved in risk management include identifying risks and assessing risks. Which of the following activities is part of the risk assessment process?
Assigning a value to each information asset
Two of the activities involved in risk management include identifying risks and assessing risks. Which of the following activities is part of the risk identification process?
Vulnerabilities
What is defined as specific avenues that threat agents can exploit to attack an information asset?
Listing assets in order of importance
What is the final step in the risk identification process?
Threats-vulnerabilities-assets worksheet
What should the prioritized list of assets and their vulnerabilities and the prioritized list of threats facing the organization be combined to create?
Product dimensions
Which of the following attributes does NOT apply to software information assets?
Manufacturer's model or part number
Which of the following distinctly identifies an asset and can be vital in later analysis of threats directed to specific models of certain devices or software components?
IP address
Which of the following is a network device attribute that may be used in conjunction with DHCP, making asset-identification using this attribute difficult?
MAC address
Which of the following is an attribute of a network device is physically tied to the network interface?
Outdated servers
Which of the following is an example of a technological obsolescence threat?
A well-defined risk appetite should have the following characteristics EXCEPT:
a It is not limited by stakeholder expectations.
Which of these denotes the overall structure of the strategic planning and design for the entirety of the organization's RM efforts?
a RM framework
Rather than making the effort to conduct a detailed assessment of the cost of recovery from an attack when estimating the danger from possible threats, organizations often __________.
a create a subjective ranking based on anticipated recovery costs
An understanding of the potential consequences of a successful attack on an information asset by a threat is known as __________.
a impact
. __________ is the risk assessment deliverable that places each information asset into a ranked list according to its value based on criteria developed by the organization.
a information asset value weighted table analysis
Once the members of the RM framework team have been identified, the governance group should communicate all of the following for the overall RM program EXCEPT:
a its personnel structure
The organization can perform risk determination using certain risk elements, including all but which of the following?
a legacy cost of recovery
What should you be armed with to adequately assess potential weaknesses in each information asset?
a properly classified inventory
What is the risk to information assets that remains even after current controls have been applied?
a residual risk
The identification, analysis, and evaluation of risk in an organization describes which of the following?
a risk assessment
The __________ converts the instructions and perspectives provided to the RM framework team into cohesive guidance that structures and directs all subsequent risk management efforts.
a risk management policy
In the area of risk management, process communications is the necessary information flow within and between all of the following EXCEPT:
a the corporate change control officer
Factors that affect the external context and impact the RM process, its goals, and its objectives include the following EXCEPT:
a the organization's governance structure
Which of the following is NOT among the typical columns in the risk rating worksheet?
a uncertainty percentage
The process of identifying risk, assessing its relative magnitude, and taking steps to reduce it to an acceptable level.
a. risk management
The quantity and nature of risk that organizations are willing to accept as they evaluate the trade-offs between perfect security and unlimited availability is known as risk __________.
appetite
35. An organization carries out a risk ____________________ function to evaluate risks present in IT initiatives and/or systems.
assessment
An evaluation of the threats to information assets, including a determination of their likelihood of occurrence and potential impact of an attack, is known as threat __________.
assessment
Risk __________ is an approach to combining risk identification, risk analysis, and risk evaluation into a single strategy.
assessment
34. An organization's information security program refers to the entire set of activities, resources, personnel, and technologies used by an organization to manage the risks to the information _______ of the organization.
assets
43. The goal of a security ____________________ program is to keep information security at the forefront of users' minds on a daily basis.
awareness
Which of the following is an attribute of a network device built into the network interface?
b MAC address
Which of these denotes the identification, analysis, evaluation, and treatment of risk to information assets?
b RM process
15. Which of the following functions includes identifying the sources of risk and may include offering advice on controls that can reduce risk?
b Risk Assessment
31. __________ is a simple project management planning tool.
b WBS
23. The purpose of SETA is to enhance security in all but which of the following ways?
b by adding barriers
18. Which of the following is NOT among the functions typically performed within the InfoSec department as a compliance enforcement obligation?
b centralized authentication
30. Which of the following is NOT a step in the process of implementing training?
b hire expert consultants
36. A study of information security positions found that positions can be classified into one of three types: ____________________ are the real technical types, who create and install security solutions.
builders
24. Advanced technical training can be selected or developed based on which of the following?
c technology product
26. Which of the following is an advantage of the one-on-one method of training?
c Customized
25. Which of the following is the first step in the process of implementing training?
c Identify program scope, goals and objectives
Which of the following activities is part of the risk identification process?
c assigning a value to each information asset
. Classification categories must be mutually exclusive and which of the following?
c comprehensive
Which of the following is not a role of managers within the communities of interest in controlling risk?
c legal management must develop corporate-wide standards
Which of the following is an example of a technological obsolescence threat?
c outdated servers
20. GGG security is commonly used to describe which aspect of security?
c physical
17. Which function needed to implement the information security program includes researching, creating, maintaining, and promoting information security plans?
c planning
The Risk Management Framework includes all of the following EXCEPT:
c process contingency planning
21. What is the SETA program designed to do?
c reduce the occurence of accidental security breaches
What is the assessment of the amount of risk an organization is willing to accept for a particular information asset?
c risk tolerance
22. A SETA program consists of three elements: security education, security training, and which of the following?.
c security awareness
Labels that must be comprehensive and mutually exclusive.
c. classification categories
Classification categories must be __________ and mutually exclusive.
comprehensive
37. The information security ____________________ is usually brought in when the organization makes the decision to outsource one or more aspects of its security program.
consultant
Which of the following is a network device attribute that may be used in conjunction with DHCP, making asset identification using this attribute difficult?
d IP address
28. Which of the following is an advantage of the formal class method of training?
d Interaction with trainer is possible
13. Which of the following variables is the most influential in determining how to structure an information security program? a. Security capital budget b. Organizational size c. Security personnel budget d. Organizational culture
d Organizational Culture
27. Which of the following is a disadvantage of the one-on-one training method?
d Resource intensive, to the point of being inefficient
Factors that affect the internal context and impact the RM process, its goals, and its objectives include the following EXCEPT:
d The threat environment—threats, known vulnerabilities, attack vectors
For an organization to manage its InfoSec risk properly, managers should understand how information is __________.
d all of these are needed
Which of the following activities is part of the risk evaluation process?
d calculating the severity of risks to which assets are exposed in their current setting
Which of the following distinctly identifies an asset and can be vital in later analysis of threats directed to specific models of certain devices or software components?
d manufacturer's model or part number
Which of the following attributes does NOT apply to software information assets?
d product dimensions
What is the final step in the risk identification process?
d ranking assets in order of importance
32. Which of the following is the most cost-effective method for disseminating security information and news to employees?
d security newsletter
Which of the following is NOT a task performed by the governance group during the framework design phase, in cooperation with the framework team?
d specifying who will supervise and perform the RM process
14. Which of the following is true about the security staffing, budget, and needs of a medium-sized organization?
d they have larger information security needs than a small organization
46. An estimate made by the manager using good judgment and experience can account for which factor of risk assessment?
d uncertainty
The recognition, enumeration, and documentation of risks to an organization's information assets.
d. risk identification
Occurs when a manufacturer performs an upgrade to a hardware component at the customer's premises.
e. field change order
The evaluation and reaction to risk to the entire organization is known as __________.
enterprise risk management (ERM)
An evaluation of the dangers to information assets, including a determination of their potential to endanger the organization.
f. threat assessment
As part of the risk identification process, listing the assets in order of importance can be achieved by using a weighted __________ worksheet.
factor analysis table analysis
As each information asset is identified, categorized, and classified, a __________ value must also be assigned to it.
relative
41. The project planner should describe the skills or personnel needed for a task, often referred to as a(n) ____________________, needed to accomplish a task.
resource
39. Project ____________________ is a description of a project's features, capabilities, functions, and quality level, used as the basis of a project plan.
scope
38. The ____________________ program is designed to reduce the occurrence of accidental security breaches by members of the organization.
security education, training, and awareness SETA
42. The three methods for selecting or developing advanced technical training are by job category, by job function, and by ____________________.
technology product
The assessment of the amount of risk an organization is willing to accept for a particular information asset is known as risk __________.
tolerance
