Exam 14: It Security Management and Risk Assessment

The purpose of ________ is to determine the basic parameters within which the risk assessment will be conducted and then to identify the assets to be examined.

A(n)_________ is a weakness in an asset or group of assets that can be exploited by one or more threats.

Detecting and reacting to incidents is not a function of IT security management.

_________ is sharing responsibility for the risk with a third party.

Implementing the risk treatment plan is part of the ______ step.

Organizational security objectives identify what IT security outcomes should be achieved.

_________ include management,operational,and technical processes and procedures that act to reduce the exposure of the organization to some risks by reducing the ability of a threat source to exploit some vulnerabilities.

The ________ has revised and consolidated a number of national and international standards into a consensus of best practice.

The intent of the ________ is to provide a clear overview of how an organization's IT infrastructure supports its overall business objectives.

The _________ approach involves conducting a risk analysis for the organization's IT systems that exploits the knowledge and expertise of the individuals performing the analysis.

The use of the _________ approach would generally be recommended for small to medium-sized organizations where the IT systems are not necessarily essential to meeting the organization's business objectives and additional expenditure on risk analysis cannot be justified.

The results of the risk analysis should be documented in a _________.

The assignment of responsibilities relating to the management of IT security and the organizational infrastructure is not addressed in a corporate security policy.

_________ is choosing to accept a risk level greater than normal for business reasons.

__________ ensures that critical assets are sufficiently protected in a cost-effective manner.

Organizational security policies identify what needs to be done.

The _________ provides the most accurate evaluation of an organization's IT system's security risks.

IT security management functions include:

A ________ is anything that might hinder or present an asset from providing appropriate levels of the key security services.

A threat may be either natural or human made and may be accidental or deliberate.