Risk Assessment and Management Flashcards

A risk assessor is following NIST SP 800-30 Rev. 1 to judge the overall likelihood of an adversarial threat event: a nation-state actor exfiltrating data through a compromised vendor update channel. Which combination of factors should determine the overall likelihood rating?

Answer: The likelihood the threat event will be initiated and the likelihood that, once initiated, it will result in adverse impact

SP 800-30 Rev. 1 treats adversarial and non-adversarial events differently. For adversarial events, the assessor first estimates the likelihood of initiation, which depends on the adversary's capability, intent, and targeting. The assessor then estimates the likelihood that the initiated event causes adverse impact, which depends on vulnerabilities and predisposing conditions. Combining these two gives the overall likelihood. Non-adversarial events, such as accidents or natural disasters, use 'likelihood of occurrence' instead of 'initiation.' CVSS scores, asset cost, and residual risk are not the defined inputs for this rating.

During a Tier 3 risk assessment, the team notes three facts: (1) the primary data center sits in a FEMA-designated 100-year floodplain, (2) the system uses a single proprietary hypervisor with no alternate vendor, and (3) a web server is missing a critical patch. Under NIST SP 800-30 Rev. 1, which items are best classified as predisposing conditions rather than vulnerabilities?

Answer: Items 1 and 2, because they are organizational or environmental conditions that raise the likelihood of adverse impact without being specific control weaknesses

SP 800-30 defines a predisposing condition as a condition within the organization, its mission or business processes, its architecture, or its environment that affects the likelihood that threat events cause adverse impact. Geographic location (the floodplain) and technology homogeneity or single-vendor dependence are standard examples. A missing patch is a weakness in a system or its controls that a threat source could exploit, so it is a vulnerability. Predisposing conditions are not limited to physical factors. Architectural and technological conditions also count.

A CGRC practitioner starts a risk assessment by listing the organization's critical mission functions and highest-value information assets. The team then asks what consequences would be most damaging, and only after that works backward to the threat events and vulnerabilities that could produce those consequences. Which SP 800-30 assessment approach is this?

Answer: Asset/impact-oriented approach

SP 800-30 describes three analysis approaches. The threat-oriented approach starts with threat sources and events. The vulnerability-oriented approach starts with exploitable weaknesses or predisposing conditions. The asset/impact-oriented approach starts with critical assets and high-impact consequences, then identifies the threats and vulnerabilities that could cause them. Starting from mission-critical functions and the worst outcomes is the defining feature of the asset/impact-oriented approach. 'Control-oriented gap analysis' is not one of the three approaches SP 800-30 defines.

After an agency deploys MFA, a WAF, and strict rate limiting on its public benefits portal, attacks on the portal fall sharply. Within weeks, the agency sees a rise in vishing calls to its help desk asking for credential resets and probing of a smaller subcontractor that has VPN access. In NIST SP 800-30 terms, what does this pattern illustrate, and what should the risk assessment do about it?

Answer: Threat shifting. The assessment should consider that adversaries may move to other targets, methods, or times in response to safeguards, and should evaluate the newly exposed paths.

SP 800-30 describes threat shifting as an adversary's response to perceived safeguards or countermeasures. The adversary changes some characteristic of its intent or targeting to avoid or work around them. Shifts can happen in the time, target, resource, or planning/attack method domains. Here the attackers moved from the hardened portal to the help desk (a new method: social engineering) and to a subcontractor (a new target). A sound assessment anticipates this and reassesses the new paths. Risk transference is a deliberate response decision, not something adversary behavior causes. Risk is never implicitly accepted by authorizing unrelated controls.

An organization switches from a purely qualitative scale (Very Low to Very High) to a semi-quantitative scale that maps each qualitative level to a numeric range, such as High = 80–95. According to SP 800-30 Rev. 1, what is the primary advantage of this change, and what is its key caution?

Answer: Advantage: it allows finer prioritization and comparison of risks within the same qualitative bin. Caution: the numbers can wrongly suggest precision, so scale definitions and their meaning must be clearly communicated.

SP 800-30 says semi-quantitative assessments use bins, scales, or representative numbers. Their benefit is that they make it easier to prioritize and compare risks, including risks that share the same qualitative label. The document also warns that the numbers can be misread as precise quantitative measures, and that subjective judgment remains. Clear definitions and explanations of what the values mean are therefore essential. Semi-quantitative values do not produce actuarially valid loss figures and do not remove subjectivity. They also should not be summed naively as if they were ratio-scale measurements.

Twelve separate information systems each have a 'Moderate' risk rating, and each falls within its own system-level authorization. On review, the risk executive function finds that all twelve inherit the same flawed enterprise identity-management common control. What is the most appropriate risk management action under NIST SP 800-30/800-39?

Answer: Perform a risk aggregation analysis at Tier 1/Tier 2, since the combined risk from the shared weakness may exceed organizational tolerance even though each system-level risk is acceptable

SP 800-30 discusses risk aggregation: combining several discrete or lower-level risks into a single, more general or higher-level risk. A common control weakness inherited by many systems is a classic case. The organization-wide exposure can be far greater than any single system's rating shows, and one exploit could compromise all twelve systems at once. SP 800-39 assigns this enterprise view to the risk executive function and to the Tier 1/Tier 2 levels. Fragmented POA&M items owned by each system ignore the common control provider's responsibility. Treating individual authorizations as sufficient misses the aggregated risk.