Deck 8: Risk Management: Identifying and Assessing Risk

Question 1

Having an established risk management program means that an organization's assets are completely protected.

Answer 1

False

Question 2

A ranked vulnerability risk worksheet assigns a ranked value or impact weight to each information asset.

Answer 2

False

Question 3

Likelihood is the overall rating of the probability that a specific vulnerability will be exploited.

Answer 3

True

Question 4

During risk identification,managers identify the organization's information assets,classify and categorize them into useful groups,and prioritize them by their overall importance.

Question 5

A well-developed risk management program consists of two formal processes: risk identification and assessment and risk control._________________________

Question 6

During risk identification managers identify the organization's information assets,classify and categorize them into useful groups,and prioritize them by their overall importance._________________________

Question 7

Risk Analysis is the process of discovering and assessing the risks to an organization's operations and determining how those risks can be controlled or mitigated.

Question 8

A community of management and users that is well trained and informed about threats facing the organization can be crucial in the early detection and response process.

Question 9

Each component of an IT system has information of value during the risk identification process.These components include people,policies,data,software,hardware and networking.

Question 10

Determining the likelihood that vulnerable systems will be attacked by specific threats is part of the risk identification process._________________________

Question 11

Assigning a value to each information asset is part of the identification process._________________________

Question 12

Assessing risks includes assigning a value to each information asset.

Question 13

The information technology community often takes on the leadership role in addressing risk.

Question 14

Information technology managers and technicians are the defenders of information._________________________

Question 15

Organizations should have a data classification scheme categorizing information assets based on their sensitivity and security needs; for example: confidential,internal and public.

Question 16

The first stage in the Risk Identification process is to develop an inventory of information assets.

Question 17

According to Sun Tzu - knowing yourself and your enemy "for every victory gained,you will suffer a defeat".

Question 18

To make the process of analyzing threats less daunting,steps in the threat and vulnerability identification processes should be handled jointly.

Question 19

The process of assigning relative values to information assets helps to ensure that assets with higher values are protected first.

Question 20

A TVA spreadsheet combines prioritized lists of assets and threats to identify vulnerabilities and provide a prioritized list of efforts relating to the implementation of needed controls.

Question 21

Which of the following activities is part of the risk assessment process?

A) Creating an inventory of information assets
B) Classifying and organizing information assets into meaningful groups
C) Assigning a value to each information asset
D) Calculating the risks to which assets are exposed in their current setting

Question 22

The final step in the risk identification process is to list the assets in order of importance.This goal can be achieved by using a(n)____ worksheet.

A) asset valuation
B) weighted factor analysis
C) asset classification
D) TVA

Question 23

Which of the following activities is part of the risk identification process?

A) Determining the likelihood that vulnerable systems will be attacked by specific threats
B) Calculating the risks to which assets are exposed in their current setting
C) Assigning a value to each information asset
D) Assessing the relative risk facing the organization's information assets

Question 24

The data classification scheme for an information asset could include confidential,internal,and private.Each of these classification categories designates the level of protection needed for a particular information asset._________________________

Question 25

The ____ is also referred to as an electronic serial number.

A) asset ID
B) MAC address
C) IP address
D) model number

Question 26

The ultimate goal of risk identification is to assess the circumstances and setting of each information asset to reveal any threats._________________________

Question 27

____ elements are divided into three categories: applications,operating systems,or security components.

A) Networking
B) Hardware
C) Software
D) Procedures

Question 28

Risk is the likelihood of the occurrence of a vulnerability multiplied by the value of the information asset minus the percentage of risk mitigated by current controls plus the uncertainty of current knowledge of the vulnerability._________________________

Question 29

The amount of danger posed by a threat is sometimes difficult to assess.It may be simply the impact of a threat attacking the organization,or it may reflect the amount of damage that the threat could create or the frequency with which an attack can occur._________________________

Question 30

People are divided into insiders (employees)and outsiders (nonemployees).Outsiders come in two categories: either they hold trusted roles and have correspondingly greater authority and accountability,or they are regular staff without any special privileges._________________________

Question 31

After a peak in 2000,the number of organizations reporting unauthorized use of computer systems has been declining steadily; the amount reporting no unauthorized access has been increasing._________________________

Question 32

The final step in the risk identification process is to list the assets in order of cost,using a weighted factor analysis worksheet._________________________

Question 33

The ____ is an effective attribute for tracking network devices and servers,but rarely applies to software.

A) name
B) asset type
C) MAC address
D) IP address

Question 34

The relative value of an information asset depends on how much revenue it generates-or,in the case of a nonprofit organization,how critical it is to service delivery._________________________

Question 35

The ____ community best understands threats and attacks that put an organization at risk.

A) information technology
B) information security
C) general management
D) users

Question 36

Classification categories must be ____ (all inventoried assets fit into a category)and ____ (each asset is found in only one category).

A) self-regulating, conscriptive
B) mutually inclusive, mutually exclusive
C) comprehensive, mutually exclusive
D) mutually exclusive, classification

Question 37

____ is the identification and assessment of levels of risk in the organizations?

A) Risk analysis
B) Risk identification
C) Risk assessment
D) Risk management

Question 38

Weighting criteria can be used to assess the value of information assets or impact evaluation._________________________

Question 39

A(n)comprehensive classification of information assets means that all inventoried assets fit into a category._________________________

Question 40

When determining the relative importance of each information asset,refer to the organization's ____ or statement of objectives.From this source,determine which assets are essential for meeting the organization's objectives,which assets support the objectives,and which are merely adjuncts.

A) mission statement
B) security plan
C) values statement
D) security policy

Question 41

The ____ uniquely identifies a specific device.

A) manufacturer's model number
B) manufacturer name
C) IP address
D) serial number

Question 42

Which of the following attributes does not apply to software information assets?

A) Serial number
B) Controlling entity
C) Logical location
D) Physical location

Question 43

____ should be avoided when identifying people assets.

A) Position titles
B) Roles
C) Security clearance levels
D) Names

Question 44

____ are specific avenues that threat agents can exploit to attack an information asset.

A) threats
B) exploits
C) vulnerabilities
D) attacks

Question 45

The simple classification scheme for an information asset of confidential,____ and public,designates the level of protection needed for a particular information asset.

A) restricted
B) private
C) exclusive
D) internal

Question 46

One of the calculations that guides corporate spending on controls is the cost of ____ operations if an attack occurs and is successful.

A) recovery
B) response
C) mitigation
D) asset valuation

Question 47

Deliberate software attacks include worms,denial of service,macros,and ____.

A) unknown loopholes
B) piracy
C) bugs
D) viruses

Question 48

Examples of technical software failures or errors include code problems,unknown loopholes,and ____.

A) bugs
B) piracy
C) employee mistakes
D) equipment failure

Question 49

What information signifies that a manufacturer performed an upgrade to a hardware component at their customer's premises?

A) Software version
B) Update revision
C) Field change order number
D) Serial number

Question 50

As each information asset is identified,categorized,and ____,a relative value must also be assigned to it.

A) prioritized
B) classified
C) labeled
D) cataloged

Question 51

Almost every organization is aware of its image in the local,national,and international spheres.Loss or ____ of some assets would prove especially embarrassing.

A) theft
B) deletion
C) exposure
D) destruction

Question 52

Which of the following is an example of human error?

A) Copyright infringement
B) Outdated technologies
C) Accidents
D) Unauthorized collection of data

Question 53

Risk is the likelihood of the occurrence of a(n)____ multiplied by the value of the information asset minus the percentage of risk mitigated by current controls plus the uncertainty of current knowledge of the vulnerability.

A) attack
B) vulnerability
C) exploit
D) assessment

Question 54

In a TVA worksheet,along one asset lies the prioritized set of ____,along the other the prioritized set of ____.

A) controls, vulnerabilities
B) assets, threats
C) risks, expenditures
D) assessments, classifications

Question 55

Which of the following distinctly identifies an asset and can be vital in later analysis of threats directed to specific models of certain devices or software components?

A) Name
B) MAC address
C) Serial number
D) Manufacturer's part number

Question 56

The ____ is an attribute that can be helpful in analyzing threat outbreaks when certain manufacturers announce specific vulnerabilities.

A) serial number
B) model number
C) manufacturer name
D) software version

Question 57

Which of the following is the final step in the risk identification process of information assets?

A) Assessing relative value
B) Listing by order of importance
C) Preparing deliverables
D) Identifying and categorizing

Question 58

The relative value of an information asset depends on how much ____ it generates-or,in the case of a nonprofit organization,how critical it is to service delivery.

A) risk
B) margin
C) revenue
D) data

Question 59

Which of the following describes an attribute that displays where an asset can be found on an organization's network?

A) Serial number
B) Logical location
C) Controlling entity
D) Physical location

Question 60

A press release is likely to fall under the ____ data classification scheme.

A) public
B) classified
C) sensitive
D) for official use only

Question 61

A(n)____________________ defense is the foundation of any information security program.

Question 62

Classification categories must be ____________________ and mutually exclusive.

Question 63

Piracy and copyright infringement are examples of the threat of compromise to ____________________ property.

Question 64

As each information asset is identified,____________________,and classified,a relative value must also be assigned to it.

Question 65

The process of evaluating potential weaknesses in each information asset is known as ____________________ identification.

Question 66

Knowing the enemy means that the threats facing an organization's information assets should be identified,examined,and ____________________.

Question 67

____________________ is the overall rating-a numerical value on a defined scale-of the probability that a specific vulnerability will be exploited.

Question 68

Risk management is the process of discovering and assessing the risks to an organization's operations and determining how those risks can be ____________________.

Question 69

Assessing risks includes determining the ____________________ that vulnerable systems will be attacked by specific threats.

Question 70

List the stages in the risk identification process in order of occurrence.

Question 71

____________________ are specific areas in which threat agents can attack an information asset.

Question 72

The last stage in the risk identification process is to document the organization's ____________________.

Question 73

Briefly describe any three standard IT system components and their respective risk management components.

Question 74

The inventory should also reflect the ____________________ and security priority assigned to each information asset.

Question 75

The standard IT system components include: people,data,networks,hardware,software,and ____________________.

Question 76

For the purposes of relative risk assessment how is risk calculated?

Question 77

A(n)____________________ number uniquely identifies a specific device.

Question 78

As part of the risk identification process,listing the assets in order of importance can be achieved by using a weighted ____________________ worksheet.