Risk Management & Threat Analysis Flashcards

What does the acronym CARVER, used for target analysis, stand for in its first two letters?

Answer: Criticality and Accessibility

CARVER stands for Criticality, Accessibility, Recuperability, Vulnerability, Effect, and Recognizability.

A design basis threat (DBT) is best described as which of the following?

Answer: A profile of adversary attributes and capabilities a protection system must defend against

The DBT defines the type, size, tactics, and capabilities of adversaries the security system is designed to defeat.

Which factor in a security risk assessment refers to the weakness that an adversary could exploit?

Answer: Vulnerability

Vulnerability is a weakness in a system or protection that can be exploited by a threat.

A security manager surveys a group of experts anonymously over several rounds until their threat estimates converge. Which technique is this?

Answer: Delphi technique

The Delphi technique uses anonymous iterative expert input to reach consensus.

Which statement best describes 'criticality' in loss event analysis?

Answer: The impact or severity of a loss if it occurs

Criticality measures the effect or consequence of a loss on the organization.

When evaluating a proposed countermeasure, the security manager should generally recommend it only when which condition is met?

Answer: Its cost is less than the reduction in expected loss it provides

A cost-benefit analysis supports controls whose cost is justified by the loss reduction they achieve.

Under the principle of 'defense in depth,' why are multiple concentric layers of protection used?

Answer: So that the failure of one layer does not leave the asset unprotected

Layered security provides redundancy and accumulates delay so a single failure does not compromise the asset.