Security Risk Management & Threat Assessment Flashcards

Which of the following is a key objective of security risk management?

Answer: Reduce risk to an acceptable level.

Security risk management aims to identify, assess, and mitigate potential threats and vulnerabilities to an organization's assets. The objective is not to eliminate all risks, which is often impossible or cost-prohibitive, but rather to implement controls that reduce risks to a level that the organization is willing to accept. This ensures a balance between security measures and operational efficiency.

What is the first step in conducting a threat assessment?

Answer: Identify potential threats.

The first and foundational step in conducting a threat assessment is to systematically identify all potential threats that could negatively impact an organization or asset. This involves brainstorming, reviewing historical data, and considering various threat actors and their capabilities. Without a clear understanding of what threats exist, effective mitigation strategies cannot be developed.

Which term describes the likelihood that a threat will exploit a vulnerability?

Answer: Risk

In security contexts, 'risk' is defined as the potential for loss or harm, which is typically expressed as a combination of the likelihood of an event occurring and the impact if it does. Specifically, it describes the probability that a given threat will successfully exploit a vulnerability. Understanding risk helps prioritize security efforts and resource allocation.

What is the purpose of a vulnerability assessment?

Answer: To identify weaknesses in a system.

A vulnerability assessment is a systematic process of identifying and quantifying security weaknesses or flaws within a system, application, or physical environment. These weaknesses, or vulnerabilities, could potentially be exploited by threats. By pinpointing these weak points, organizations can then prioritize and implement appropriate security controls to strengthen their defenses and reduce overall risk.

What is an example of a physical security control?

Answer: Motion detector

Physical security controls are tangible measures designed to protect physical assets, facilities, and personnel from unauthorized access or harm. A motion detector is an excellent example, as it physically senses movement and triggers an alarm or other response. Other common physical security controls include fences, locks, security guards, and surveillance cameras.

Which element is NOT part of the risk assessment process?

Answer: Marketing strategy

The risk assessment process typically involves several key steps: identifying threats, analyzing vulnerabilities, determining the likelihood and impact of risks, and evaluating existing controls. Marketing strategy, which focuses on promoting products or services, is entirely unrelated to the core components of identifying and managing security risks within an organization.

What does CPTED stand for in threat assessment?

Answer: Crime Prevention Through Environmental Design

CPTED stands for Crime Prevention Through Environmental Design. It is a multidisciplinary approach to deterring criminal behavior through the thoughtful design and management of the built environment. CPTED principles, such as natural surveillance and access control, aim to reduce opportunities for crime and create safer spaces by influencing human behavior.

What role does access control play in risk management?

Answer: It prevents unauthorized access.

Access control is a fundamental security measure designed to regulate who or what can view or use resources within a system or physical space. By implementing mechanisms like keycards, biometric scanners, or user authentication, access control ensures that only authorized individuals or entities can gain entry or interact with sensitive assets, thereby preventing unauthorized access and reducing risk.

Which of the following best defines 'residual risk'?

Answer: Risk left after controls are implemented.

Residual risk refers to the level of risk that remains after all security controls, countermeasures, and mitigation strategies have been implemented. It's the risk that an organization accepts because it cannot be entirely eliminated or because the cost of further mitigation outweighs the potential benefit. Understanding residual risk is crucial for ongoing risk management and decision-making.