Exam 9: Risk Management: Controlling Risk

Mitigation of risk involves applying safeguards that eliminate or reduce the remaining uncontrolled risks._________________________

One of the most common methods of obtaining user acceptance and support is via ____.

Management consultants Tom Peters and Robert Waterman assert that one of the eight characteristics of excellent organizations is that they "stick to their knitting",which means ____.

Residual risk is also known as risk tolerance and is the amount of risk organizations are willing to accept after all reasonable controls have been implemented.

The effectiveness of controls should be ____________________ and measured regularly once a control strategy has been selected.

____ is the quantity and nature of risk that organizations are willing to accept as they evaluate the trade-offs between perfect security and unlimited accessibility.

Due care and due diligence occur when an organization adopts a certain minimum level of security as what any ____ organization would do in similar circumstances.

Organizations can establish a competitive business model,method,or technique allowing it to provide a product or service that is superior in some way creating competitive disadvantage._________________________

ISO ____ is the ISO standard for the performance of risk management,and includes a five-stage risk management methodology.

Economic and non-economic effects of a weakness must be evaluated after a strategy for dealing with a particular vulnerability has been selected.

The goal of information security is to bring residual risk in line with an organization's risk appetite._________________________

A cost benefit analysis (CBA)result is obtained from the difference between the pre-control and the ____________________ annualized loss expectancy (ALE).

Discuss at least four alternatives to feasibility.

Avoidance of risk is accomplished through the application of procedures,training and education and the implementation of technical security controls and safeguards._________________________

Which of the following is NOT an alternative to cost-benefit analyses?

Unlike other risk management frameworks,FAIR relies on the ____ assessment of many risk components using scales with value ranges,for example very high to very low.

In Risk Management is asset valuation,as it is relatively easy to determine accurately the true value of information and information-bearing assets.

Unlike other risk management frameworks,FAIR relies on the qualitative assessment of many risk components using scales with value ranges,for example very high to very low.

One of the most common methods of obtaining user acceptance and support is via user ____________________ .

The risk control strategy that seeks to reduce the impact of a successful attack through the use of IR,DR and BC plans is ____________________ .