Security & Risk Management Flashcards

What is the primary goal of security risk management?

Answer: To identify and assess risks, then mitigate them

The primary goal of security risk management is a systematic process of identifying potential threats and vulnerabilities to an organization's assets. Once identified, these risks are assessed for their likelihood and potential impact. The final step involves implementing appropriate controls and strategies to mitigate or reduce these risks to an acceptable level.

Which of the following is a key component of a risk management strategy?

Answer: Identifying risks and implementing controls

A robust risk management strategy fundamentally involves two key steps: first, thoroughly identifying all potential risks that could impact an organization's assets or operations. Second, it requires implementing appropriate security controls and countermeasures to either eliminate, reduce, or transfer these identified risks. This proactive approach minimizes vulnerabilities and protects critical resources.

What is a vulnerability in cybersecurity risk management?

Answer: A weakness that can be exploited

In cybersecurity risk management, a vulnerability refers to a flaw or weakness in a system, application, or process that could be exploited by a threat actor. Examples include unpatched software, weak configurations, or poor security practices. These weaknesses create opportunities for threats to cause harm, making their identification crucial for effective security.

How does risk mitigation reduce overall risk exposure?

Answer: By reducing the likelihood and impact of risks

Risk mitigation involves implementing strategies and controls designed to lessen the probability of a risk occurring and/or reduce the severity of its consequences if it does occur. By actively addressing identified vulnerabilities and threats, organizations can significantly decrease their overall exposure to potential harm. This proactive approach helps protect assets and maintain business continuity.

Which approach is used in risk management for controlling identified risks?

Answer: By transferring, avoiding, or controlling risks

Risk management employs several strategies to handle identified risks. Risk transfer involves shifting the financial burden to another party, often through insurance. Risk avoidance means eliminating the activity that creates the risk. Risk control (or mitigation) involves implementing measures to reduce the likelihood or impact of the risk.

What is an example of a physical security risk?

Answer: Theft or fire damage

Physical security risks pertain to threats that can directly harm or compromise an organization's physical assets, infrastructure, or personnel. Theft of equipment, unauthorized physical access, or damage from environmental factors like fire or flood are prime examples. These risks require physical controls such as locks, surveillance, and fire suppression systems.

How often should risk assessments be conducted?

Answer: Regularly or as changes occur

Risk assessments should not be a one-time event but rather an ongoing process. Regular assessments ensure that an organization's risk profile remains current and that controls are effective against evolving threats. Furthermore, any significant changes to systems, processes, or the business environment necessitate a new assessment to identify new or altered risks.

What does the term ‘residual risk’ mean?

Answer: Risk after implementing controls

Residual risk refers to the level of risk that remains after all planned and implemented security controls and mitigation strategies have been applied. It's the risk that an organization accepts because it cannot be entirely eliminated or the cost of further mitigation outweighs the potential benefits. Understanding residual risk is crucial for informed decision-making.

What is a risk register?

Answer: A list of identified risks and management actions

A risk register is a comprehensive document or database used in risk management to record and track all identified risks within a project or organization. For each risk, it typically includes details such as its description, likelihood, impact, priority, assigned owner, and the planned mitigation or response actions. It serves as a central repository for risk information and monitoring.