Core Concepts and Principles Flashcards

In most security risk assessment models, risk is evaluated as a function of which three elements?

Answer: Threat, vulnerability, and consequence

Security risk is commonly expressed as a combination of threat, vulnerability, and the consequence or impact of a loss.

A company buys an insurance policy to cover potential losses from cargo theft. Which risk treatment strategy does this represent?

Answer: Risk transfer

Insurance shifts the financial impact of a loss to a third party, which is risk transfer.

What is the main purpose of applying defense in depth to a protected asset?

Answer: To make sure the failure of one control does not expose the asset

Layered controls provide redundancy, so an adversary must defeat several independent barriers.

For a physical protection system to be effective, how should adversary task time compare with the response force time?

Answer: Response force time should be shorter than the adversary's remaining task time after detection

Delay after detection must last longer than the time responders need to arrive and interrupt the adversary.

Which of the following is an intangible asset?

Answer: Corporate reputation

Reputation has no physical form but has significant value and can be damaged by security incidents.

In loss event analysis, what does 'criticality' measure?

Answer: The impact or severity of a loss if it occurs

Criticality refers to how serious a loss would be to the organization, as opposed to its probability.

What term describes the level of risk that remains after security controls have been put in place?

Answer: Residual risk

Residual risk is what is left after countermeasures, and management must decide whether to accept it.