Exam 14: It Security Management and Risk Assessment

The four approaches to identifying and mitigating risks to an organization's IT infrastructure are: baseline approach,detailed risk analysis,combined approach,and __________ approach.

_________ is choosing to accept a risk level greater than normal for business reasons.

________ specification indicates the impact on the organization should the particular threat in question actually eventuate.

Establishing security policy,objectives,processes and procedures is part of the ______ step.

The ________ has revised and consolidated a number of national and international standards into a consensus of best practice.

One asset may have multiple threats and a single threat may target multiple assets.

The __________ approach to risk assessment aims to implement a basic general level of security controls on systems using baseline documents,codes of practice,and industry best practice.

The advantages of the _________ risk assessment approach are that it provides the most detailed examination of the security risks of an organization's IT system and produces strong justification for expenditure on the controls proposed.

Legal and regulatory constraints may require specific approaches to risk assessment.

IT security management has evolved considerably over the last few decades due to the rise in risks to networked systems.

ISO details a model process for managing information security that comprises the following steps: plan,do,________,and act.

The _________ approach combines elements of the baseline,informal,and detailed risk analysis approaches.

The _________ approach involves conducting a risk analysis for the organization's IT systems that exploits the knowledge and expertise of the individuals performing the analysis.

IT security management consists of first determining a clear view of an organization's IT security objectives and general risk profile.

A threat may be either natural or human made and may be accidental or deliberate.

IT security management functions include:

IT security needs to be a key part of an organization's overall management plan.

Maintaining and improving the information security risk management process in response to incidents is part of the _________ step.

Implementing the risk treatment plan is part of the ______ step.

_________ is a process used to achieve and maintain appropriate levels of confidentiality,integrity,availability,accountability,authenticity,and reliability.