Exam 9: Risk Management: Controlling Risk

The ____ technique,named for the Greek mythological oracle which predicted the future is a process whereby a group rates or ranks a set of information.

At a minimum,each information asset-threat pair should have a(n)____ that clearly identifies any residual risk that remains after the proposed strategy has been executed.

According to the Microsoft Risk Management Approach,risk management is not a stand-alone subject and should be part of a general governance program to allow the organization's management to evaluate the organization's operations and make better,more informed decisions.

When you establish one control,you increase the risk associated with all subsequent control evaluations._________________________

____ is the money saved by avoiding,via the implementation of a control,the financial ramifications of an incident.

The four categories of controlling risk include avoidance,mitigation,transference and _____.

The threat level and an asset's ____________________ should be a major factor in the risk control strategy selection.

Risk ____________________ defines the quantity and nature of risk that an organization is willing to accept.

____ is the process of assigning financial value or worth to each information component.

The ____________________ technique is process in which a group ranks a set of information.

The Annualized Loss Expectancy in the CBA formula is determined as ____.

Risk appetite is also known as risk ____________________.

The ____________________ assessment,tries to improve upon the ambiguity of qualitative measures without resorting to the unsubstantiated estimation used for quantitative measures.

The ISO 27005 Standard for Information Security Risk Management includes five stages including all but which of the following?

An organization that chooses to outsource its risk management practice to independent consultants is taking the ____ control approach.

An alternate set of possible risk control strategies includes all but which of the following?

Reducing the impact of a successful attack on an organization's system falls under the ____ risk control strategy.

Briefly describe the four basic strategies to control risk that result from vulnerabilities.

OCTAVE is an InfoSec risk evaluation methodology that allows organizations to balance the protection of critical information assets against the costs of providing protective and detection controls.

What is a cost/benefit analysis and how is it calculated?