Chapter 5 HS155

False (cost avoindance)

Cost mitigation ​is the process of preventing the financial impact of an incident by implementing a control.

False (risk appetite)

Risk acceptance defines the quantity and nature of risk that organizations are willing to accept as they evaluate the trade-offs between perfect security and unlimited accessibility.

True

Risk control is the application of controls that reduce the risks to an organization's information assets to an acceptable level.

False (risk identification)

Risk control is the enumeration and documentation of risks to an organization's information assets.

False (risk assessment)

Risk mitigation is the process of assigning a risk rating or score to each information asset

True

Some information security experts argue that it is virtually impossible to determine the true value of information and information-bearing assets.

True

The threats-vulnerabilities-assets (TVA) worksheet is a document that shows a comparative ranking of prioritized assets against prioritized threats, with an indication of any vulnerabilities in the asset/threat pairings.

True

The upper management of an organization must structure the IT and information security functions to defend the organization's information assets.

True

The value of information to the organization's competition should influence the asset's valuation.

True

To determine if the risk to an information asset is acceptable or not, you estimate the expected loss the organization will incur if the risk is exploited.

True

When determining the relative importance of each asset, refer to the organization's mission statement or statement of objectives to determine which elements are essential, which are supportive, and which are merely adjuncts.

True

When it is necessary to calculate, estimate, or derive values for information assets, you might give consideration to the value incurred from the cost of protecting the information.

False

Within a data classification scheme, "comprehensive" means that an information asset should fit in only one category.

False (comprehensive and mutually exclusive)

Within data classification schemes, it is important that all categories used be classified and mutually exclusive.

False (qualitative and quantitative)

You cannot use qualitative measures to rank information asset values.

True

You should adopt naming standards that do not convey information to potential system attackers.

False

A best practice proposed for a small to medium-sized business will be similar to one used to help design control strategies for a large multinational company.

False (level of confidentiality)

A data classification scheme is a formal access control methodology used to assign a level of availability to an information asset and thus restrict the number of people who can access it.

False (data they may access)

A security clearance is a component of a data classification scheme that assigns a status level to systems to designate the maximum level of classified data that may be stored on them.

False (Bussiness Continuity Plan)

A(n) disaster recovery plan includes the steps necessary to ensure the continuation of the organization when a disaster's scope or scale exceeds the ability of the organization to restore operations, usually through relocation of critical business functions to an alternate location.

True

A(n) qualitative assessment is based on characteristics that do not use numerical measures.

False (need not fear battles)

According to Sun Tzu, if you know yourself and know your enemy, you have an average chance to be successful in an engagement.

False (future performance)

Baselining is the comparison of past security activities and events against the organization's current performance.

True

Benchmarking is the process of comparing other organizations' activities against the practices used in one's own organization to produce results it would like to duplicate.

True

Best business practices are often called recommended practices.

False (it can be calculated)

Cost-benefit analyses (CBAs) cannot be calculated after controls have been functioning for a time, as observation over time prevents precision in evaluating the benefits of the safeguard and determining whether it is functioning as intended.

False (threat assessment)

Each of the threats faced by an organization must be evaluated, including determining the threat's potential to endanger the organization, which is known as a threat prioritization.

True

Establishing a competitive business model, method, or technique enables an organization to provide a product or service that is superior and creates a(n) competitive advantage.

True

Exposure factor is the expected percentage of loss that would occur from a particular attack.

False (human resource is more difficult to identify)

Identifying human resources, documentation, and data information assets of an organization is less difficult than identifying hardware and software assets.

True

If the acceptance strategy is used to handle every vulnerability in the organization, its managers may be unable to conduct proactive security activities and may portray an apathetic approach to security in general.

False (asset value x exposure factor)

In a cost-benefit analysis, a single loss expectancy (SLE) is the calculated value associated with the most likely loss from an attack; the SLE is the product of the asset's value and the annualized loss expectancy.

True

In addition to their other responsibilities, the three communities of interest are responsible for determining which control options are cost effective for the organization.

False (knowing your enemy)

Knowing yourself means identifying, examining, and understanding the threats facing the organization.

True

Likelihood is the probability that a specific vulnerability within an organization will be the target of an attack.

False (loss magnitude)

Loss event frequency is the combination of an asset's value and the percentage of it that might be lost in an attack.

False

One advantage to benchmarking is that best practices change very little over time.

True

One way to determine which information assets are valuable is by evaluating which information asset(s) would expose the company to liability or embarrassment if revealed.

False (technical feasibility)

Operational feasibility is an assessment of whether the organization can acquire the technology necessary to implement and support the proposed control.

True

Organizations should communicate with system users throughout the development of the security program, letting them know that changes are coming, and reduce resistance to these expected changes through communication, education, and involvement.

False (residual risk)

Pervasive risk is the amount of risk that remains to an information asset even after the organization has applied its desired level of controls.

False (metrics based measure)

Process-based measures are comparisons based on observed numerical data, such as numbers of successful attacks.

False (more strategic)

Process-based measures are performance measures that are focused on numbers and are less strategic than metric-based measures.

False (vulnerabilities have been controlled)

Residual risk is the risk that has not been removed, shifted, or planned for after vulnerabilities have been completely resolved.

False (residual risk)

TVA safeguard risk is a combined function of (1) a threat less the effect of threat-reducing safeguards, (2) a vulnerability less the effect of vulnerability-reducing safeguards, and (3) an asset less the effect of asset value-reducing safeguards.

False (CBA)

The computed value of the ALE compares the costs and benefits of a particular control alternative to determine whether the control is worth its cost.

False (risk control strategy)

The defense control strategy is the risk control strategy that attempts to eliminate or reduce any remaining uncontrolled risk through the application of additional controls and safeguards, but it is not the preferred approach to controlling risk.

True

The mitigation control strategy attempts to reduce the impact of a successful attack through planning and preparation.

True

The most common example of a mitigation procedure is a contingency plan.

True

The results from risk assessment activities can be delivered in a number of ways: a report on a systematic approach to risk control, a project-based risk assessment, or a topic-specific risk assessment.