Deck 9: Risk Management: Controlling Risk

Question 1

Asset valuation does NOT have to consider the value of information to adversaries or loss of revenue while information assets are unavailable.

Answer 1

False

Question 2

Communicating new or revised policy to employees is adequate to assure compliance.

Answer 2

False

Question 3

Economic and non-economic effects of a weakness must be evaluated after a strategy for dealing with a particular vulnerability has been selected.

Answer 3

False

Question 4

Avoidance of risk is the choice to forgo the use of security measures and accept loss in the event of an attack._________________________

Question 5

According to the Microsoft Risk Management Approach,risk management is not a stand-alone subject and should be part of a general governance program to allow the organization's management to evaluate the organization's operations and make better,more informed decisions.

Question 6

Organizations can establish a competitive business model,method,or technique allowing it to provide a product or service that is superior in some way creating competitive disadvantage._________________________

Question 7

Risks can be avoided by countering the threats that an asset faces.

Question 8

Corporations that previously used IT systems to gain a competitive advantage now are faced with competitive disadvantage if they fail to keep up with changes in technology.

Question 9

The final choice of a risk control strategy may call for a balanced mixture of controls that provides the greatest value for as many asset-threat pairs as possible.

Question 10

Economic feasibility is a standard that is commonly used when evaluating a project that implements information security safeguards.

Question 11

Common sense dictates that an organization should spend more to protect an asset than its value.

Question 12

OCTAVE is an InfoSec risk evaluation methodology that allows organizations to balance the protection of critical information assets against the costs of providing protective and detection controls.

Question 13

A system's exploitable vulnerabilities are usually determined after the system is designed.

Question 14

Avoidance of risk is accomplished through the application of procedures,training and education and the implementation of technical security controls and safeguards._________________________

Question 15

In Risk Management is asset valuation,as it is relatively easy to determine accurately the true value of information and information-bearing assets.

Question 16

The goal of information security is to bring residual risk to zero.

Question 17

The risk control strategy of avoidance means understanding the consequences and avoiding risk by not placing a system in a situation that could result in a loss..

Question 18

Residual risk is also known as risk tolerance and is the amount of risk organizations are willing to accept after all reasonable controls have been implemented.

Question 19

Unlike other risk management frameworks,FAIR relies on the qualitative assessment of many risk components using scales with value ranges,for example very high to very low.

Question 20

Mitigation of risk involves applying safeguards that eliminate or reduce the remaining uncontrolled risks._________________________

Question 21

Step-by-step rules to regain normalcy is covered by which of the following plans in the mitigation control approach?

A) Incident response plan
B) Business continuity plan
C) Disaster recovery plan
D) Damage control plan

Question 22

Behavioral feasibility refers to user acceptance and support,management acceptance and support,and the system's compatibility with the requirements of the organization's stakeholders._________________________

Question 23

Risk appetite (also known as risk tolerance)is the quantity and nature of risk that organizations are willing to accept as they evaluate the trade-offs between perfect security and unlimited accessibility._________________________

Question 24

Which of the following is not an example of a disaster recovery plan?

A) Data recovery procedures
B) Reestablishment of lost service procedures
C) Information gathering procedures
D) Shut down procedures

Question 25

An organization that chooses to outsource its risk management practice to independent consultants is taking the ____ control approach.

A) avoidance
B) mitigation
C) transference
D) acceptance

Question 26

The goal of information security is to bring residual risk in line with an organization's risk appetite._________________________

Question 27

When the attacker's potential gain is greater than the costs of attack,you should apply protections to increase the attacker's cost or reduce the attacker's gain,by using technical or managerial controls._________________________

Question 28

Mitigation depends on the ability to detect and respond to an attack as quickly as possible ._________________________

Question 29

Application of training and education is a technique of the ____ control strategy.

A) mitigation
B) avoidance
C) acceptance
D) transference

Question 30

The only use of the acceptance strategy that industry practices recognize as valid occurs when the organization has done all but which of the following?

A) Determined the level of risk posed to the information asset
B) Performed a thorough cost-benefit analysis
C) Determined that the particular function, service, information, or asset did justify the cost of additional protection
D) Assessed the probability of attack and the likelihood of a successful exploitation of a vulnerability

Question 31

Cost Benefit Analysis is determined by calculating the single loss expectancy before new controls minus the annualized loss expectancy after controls are implemented minus the annualized cost of the safeguard._________________________

Question 32

An alternate set of possible risk control strategies includes all but which of the following?

A) Self-protection: Applying safeguards that eliminate or reduce the remaining uncontrolled risks for the vulnerability
B) Self-insurance: Understanding the consequences and accepting the risk without control or mitigation
C) Avoidance: Avoiding certain activities because the risk is too great compared to the benefits
D) Obscurity: Hiding critical security assets in order to protect them from attack

Question 33

Reducing the impact of a successful attack on an organization's system falls under the ____ risk control strategy.

A) acceptance
B) mitigation
C) transference
D) avoidance

Question 34

Asset evaluation is the process of assigning financial worth to each information asset._________________________

Question 35

When a vulnerability (flaw or weakness)exists,you should implement security policies to reduce the likelihood of a vulnerability being exercised._________________________

Question 36

Which of the following describes an organization's efforts to reduce damage caused by the exploitation of vulnerability?

A) Acceptance
B) Avoidance
C) Transference
D) Mitigation

Question 37

Which of the following plans would not be a considered a mitigation control approach?

A) Incident response plan
B) Acceptance plan
C) Disaster recovery plan
D) Business continuity plan

Question 38

The original OCTAVE method,which forms the basis for the OCTAVE body of knowledge was designed for large organizations with 300 or more users,while OCTAVE-Allegro was designed for smaller organizations of about 100 users._________________________

Question 39

The Microsoft Risk Management Approach includes four phases: assessing risk,conducting decision support,implementing controls and measuring program effectiveness._________________________

Question 40

When you establish one control,you increase the risk associated with all subsequent control evaluations._________________________

Question 41

____ feasibility determines acceptable practices based on consensus and relationships among the communities of interest.

A) Organizational
B) Political
C) Technical
D) Operational

Question 42

____ feasibility evaluates how proposed information security alternatives will contribute to the efficiency,effectiveness,and overall operation of an organization.

A) Operational
B) Organizational
C) Technical
D) Political

Question 43

Asset valuation must account for value _____.

A) from providing the information
B) acquired from the cost of protecting the asset
C) of intellectual property
D) All of these

Question 44

Which of the following is NOT an alternative to cost-benefit analyses?

A) Benchmarking
B) Due care/due diligence
C) Baselining
D) ISO 17799 based controls

Question 45

The Microsoft Risk Management Approach includes four phases.Which of the following is NOT one of them?

A) Assessing risk
B) Implementing controls
C) Building executive consensus
D) Measuring program effectiveness

Question 46

The ____ is the indication of how often you expect a specific type of attack to occur.

A) SLE
B) ALE
C) CBA
D) ARO

Question 47

Which of the following is NOT among the items that affect the cost of a control?

A) Training fees
B) Service costs
C) Asset resell costs
D) Maintenance costs

Question 48

Unlike other risk management frameworks,FAIR relies on the ____ assessment of many risk components using scales with value ranges,for example very high to very low.

A) qualitative
B) quantitative
C) risk
D) calculated

Question 49

____ feasibility examines whether the organization has access to the technology necessary to manage control alternatives.

A) Political
B) Operational
C) Technical
D) Organizational

Question 50

The four categories of controlling risk include avoidance,mitigation,transference and _____.

A) inference
B) investigation
C) deterrence
D) acceptance

Question 51

A cost-benefit analysis is calculated by subtracting the post-control annualized loss expectancy and the ____ from the pre-control loss expectancy

A) annualized cost of the safeguard
B) exposure factor
C) annualized rate of occurrence
D) asset value

Question 52

____ feasibility is also referred to as behavioral feasibility.

A) Operational
B) Organizational
C) Political
D) Technical

Question 53

In a cost-benefit analysis,the ____ is the value to the organization of using controls to prevent losses associated with a specific vulnerability.

A) cost
B) benefit
C) loss expectancy
D) asset value

Question 54

Management consultants Tom Peters and Robert Waterman assert that one of the eight characteristics of excellent organizations is that they "stick to their knitting",which means ____.

A) branching into the textile industry
B) staying reasonably close to the business they know
C) they outsource their information security functions
D) they must hire other organizations to perform all electronic commerce services

Question 55

The ____ is the calculation of the value associated with the most likely loss from an attack.

A) SLE
B) ALE
C) CBA
D) ARO

Question 56

____ is the quantity and nature of risk that organizations are willing to accept as they evaluate the trade-offs between perfect security and unlimited accessibility.

A) Residual risk
B) Risk appetite
C) Risk assurance
D) Risk management

Question 57

____ is the process of assigning financial value or worth to each information component.

A) Asset valuation
B) Cost-benefit analysis
C) Auditing
D) Accountability

Question 58

The annualized loss expectancy equals the single loss expectancy times ____.

A) annualized cost of the safeguard
B) exposure factor
C) annualized rate of occurrence
D) asset value

Question 59

A single loss expectancy is calculated by multiplying the asset value by the ____.

A) annualized cost of the safeguard
B) exposure factor
C) annualized rate of occurrence
D) asset value

Question 60

Which of the following is NOT a valid rule of thumb on risk control strategy selection?

A) When a vulnerability exists: Implement security controls to reduce the likelihood of a vulnerability being exercised.
B) When a vulnerability can be exploited: Apply layered protections, architectural designs, and administrative controls to minimize the risk or prevent the occurrence of an attack.
C) When the attacker's potential gain is less than the costs of attack: Apply protections to decrease the attacker's cost or negate the attacker's gain, by using technical or operational controls.
D) When the potential loss is substantial: Apply design principles, architectural designs, and technical and non-technical protections to limit the extent of the attack, thereby reducing the potential for loss.

Question 61

Some information assets acquire value over time that is beyond their ____ value-the essential worth-of the asset.This higher acquired value is the more appropriate value in most cases.

A) extrinsic
B) intrinsic
C) evaluated
D) estimated

Question 62

____ is the choice to do nothing to protect an information asset from risk and to accept the outcome from any resulting exploitation.

A) Avoidance
B) Acceptance
C) Mitigation
D) Risk tolerance

Question 63

Select the list of mitigation strategies in terms of timeframe from most immediate to longest-term:

A) CBA - SLE - ARO
B) CBA - ALE - SLE
C) IR - DR - BC
D) IR - BC - DR

Question 64

At a minimum,each information asset-threat pair should have a(n)____ that clearly identifies any residual risk that remains after the proposed strategy has been executed.

A) risk management plan
B) documented control strategy
C) asset valuation
D) cost-benefit analysis

Question 65

A more granular approach to asset valuation,the ____ assessment,tries to improve upon the ambiguity of qualitative measures without resorting to the unsubstantiated estimation used for quantitative measures,and uses scales rather than specific estimates.

A) Delphi
B) hybrid
C) cost-benefit analysis
D) qualitative

Question 66

In the Cost-Benefit Analysis Formula presented in the text,ACS stands for ____.

A) actual cost of security
B) annualized cost of security
C) alternate control strategy
D) annualized cost of the safeguard

Question 67

The Annualized Loss Expectancy in the CBA formula is determined as ____.

A) ALE * ARO
B) SLE * ARO
C) ACS - SLE(post)
D) AV * EF

Question 68

Some organizations document the outcome of the control strategy for each information asset-threat pair in a(n)_____,which includes concrete tasks with accountability for each task being assigned to an organizational unit or to an individual.

A) risk management plan
B) control strategy
C) cost-benefit analysis
D) action plan

Question 69

The ____ technique,named for the Greek mythological oracle which predicted the future is a process whereby a group rates or ranks a set of information.

A) Euripides
B) Artemis
C) Aesop
D) Delphi

Question 70

Due care and due diligence occur when an organization adopts a certain minimum level of security as what any ____ organization would do in similar circumstances.

A) hybrid
B) modern
C) prudent
D) benchmarking

Question 71

In the Cost-Benefit Analysis Formula presented in the text,ALE is calculated by ____.

A) SLE * ARO
B) SLE * ACS
C) SLE(prior) - SLE(post)
D) asset value times exposure factor

Question 72

____ is the money saved by avoiding,via the implementation of a control,the financial ramifications of an incident.

A) Cost - Benefit Analysis
B) Cost avoidance
C) Economic feasibility
D) Financial acceptance

Question 73

Residual risk is a combined function of all but which of the following?

A) A threat less the effect of threat-reducing safeguards
B) A vulnerability less the effect of vulnerability-reducing safeguards
C) An asset less the effect of asset value-reducing safeguards
D) Residual risk less a factor of error

Question 74

____ is usually determined by valuing the information asset or assets exposed by the vulnerability and then determining how much of that value is at risk,and how much risk exists for the asset.

A) Risk
B) Asset value
C) Cost
D) Benefit

Question 75

If,during a risk-handling evaluation,the organization determines that there is a valid threat source and the system is vulnerable to attack then ____.

A) risk of loss exists
B) risk can be accepted
C) the system is exploitable
D) unacceptable risk must be controlled

Question 76

One of the most common methods of obtaining user acceptance and support is via ____.

A) cost-benefit analysis
B) user involvement
C) user acceptance
D) behavioral feasibility

Question 77

Once a control strategy has been selected and implemented,controls should be ____ on an ongoing basis to determine their effectiveness and to estimate the remaining risk.

A) budgeted
B) updated
C) monitored and measured
D) evaluated and funded

Question 78

Before deciding on the risk control strategy for a specific vulnerability,an organization must explore all readily accessible information about the ____ consequences of the vulnerability.

A) cost avoidance
B) risk
C) economic and non-economic
D) feasibility

Question 79

If the organization has information assets totaling 1 million dollars,how much should the organization spend to protect them?

A) $10,000
B) $100,000
C) 1 million dollars
D) an appropriate amount determined through an effective cost-benefit analysis

Question 80

ISO ____ is the ISO standard for the performance of risk management,and includes a five-stage risk management methodology.

A) 27001
B) 27002
C) 27004
D) 27005