StudyXY
RegisterLog in
Information Technology /Security+ (SY0-701): Lesson 15: Risk Management Part 2

Security+ (SY0-701): Lesson 15: Risk Management Part 2

Information Technology30 CardsCreated about 2 months ago

This deck covers key concepts in risk management, including definitions, frameworks, and processes essential for understanding and managing risk within an organization.

PrintEmbedImportReport

Define 'risk exemption'

A condition where risk can remain without mitigation, usually due to a strategic business decision.
Tap or swipe ↕ to flip
Swipe ←→Navigate
SSpeak
FFocus
1/30

Key Terms

Term
Definition
Define 'risk exemption'
A condition where risk can remain without mitigation, usually due to a strategic business decision.
Define 'residual risk'
Risk that remains even after controls (mitigation/transference/exemption/exception) are put into place.
Define 'risk appetite'
How much risk and what types of risk an organization is willing to take to fulfill its organizational goals and objectives.

In order, list the 5 phases of risk management

  1. Identify Mission Essential Functions

  2. Identify Vulnerabilities

  3. Identify Threats

  4. Analyze Busines...

What are the two main variables when calculating risk?
Likelihood and Impact.
Define 'risk likelihood'
Qualitative analysis used to describe the chance of a risk event happening; Low/Med/High or on some form of a numeric scale.
Log in to view all terms

Related Flashcard Decks

Information Technology

Security+ (SY0-701): Additional Knowledge

This flashcard set explores various cybersecurity topics including credential-stuffing attacks, data classification (e.g., private data), and key disaster recovery metrics like RTO. It also highlights protective measures such as hashing for data integrity, automation support challenges, and the use of URL scanning in web filtering to prevent malware infections.

10 cards
View Deck
Information Technology

Security+ (SY0-701): Cert Master Practice: 5.0 Security Program Management and Oversight

This flashcard set covers key concepts in cybersecurity governance frameworks, including centralized governance, data stewardship roles, and compliance laws like SOX. It also addresses environments supporting development and change management, as well as recovery strategies like Recovery Point Objective (RPO) to minimize data loss during system failures.

8 cards
View Deck
Information Technology

Security+ (SY0-701): Cert Master Practice: 4.0 Security Operations

This flashcard set explores advanced cybersecurity practices including refining SIEM alert handling, email security protocols (DKIM, DMARC), secure authentication methods, and strategic threat-hunting. It emphasizes how to enhance incident response efficiency and leverage proactive defense techniques like maneuvering to counteract potential threats.

11 cards
View Deck
Information Technology

Security+ (SY0-701): Cert Master Practice; 2.0 Threats, Vulnerabilities, and Mitigations

This deck covers key concepts related to threats, vulnerabilities, and mitigations in cybersecurity, focusing on virtual machine security.

1 cards
View Deck
Information Technology

Security+ (SY0-701): Cert Master Practice; 1.0 General Security Concepts

This flashcard deck covers key concepts from the Security+ (SY0-701) exam, focusing on general security concepts such as technical and operational controls, policy enforcement, and tokenization.

6 cards
View Deck
Information Technology

Security+ (SY0-701): Lesson 16: Summarize Data Protection Part 2

This flashcard deck covers key concepts from the Security+ (SY0-701) Lesson 16, focusing on data protection methods, DLP components, and security awareness training.

25 cards
View Deck

Study Tips

  • Press F to enter focus mode for distraction-free studying
  • Review cards regularly to improve retention
  • Try to recall the answer before flipping the card
  • Share this deck with friends to study together
Security+ (SY0-701): Lesson 15: Risk Management Part 2
TermDefinition
Define 'risk exemption'
A condition where risk can remain without mitigation, usually due to a strategic business decision.
Define 'residual risk'
Risk that remains even after controls (mitigation/transference/exemption/exception) are put into place.
Define 'risk appetite'
How much risk and what types of risk an organization is willing to take to fulfill its organizational goals and objectives.

In order, list the 5 phases of risk management

  1. Identify Mission Essential Functions

  2. Identify Vulnerabilities

  3. Identify Threats

  4. Analyze Business Impacts

  5. Identify Risk Response

What are the two main variables when calculating risk?
Likelihood and Impact.
Define 'risk likelihood'
Qualitative analysis used to describe the chance of a risk event happening; Low/Med/High or on some form of a numeric scale.
Define 'risk impact'
The severity of the risk if realized as a security incident.
Define 'risk probability'
Quantitative measure typically expressed as a numerical value to precisely measure the chance of a risk event occurring based on statistical methods.
What are NIST's Risk Management Framework (RMF) or ISO 31K?
They are enterprise risk management (ERM) policies and procedures.
Define a 'risk register'
A document showing the results of risk assessments that includes information regarding risks, their severity, the associated owner of the risk, and all identified mitigation strategies.
Define a 'risk threshold'
Determines risk acceptance; defines the limits or levels of acceptable risk an organization is willing to tolerate.
What are factors that define a risk threshold?
Regulatory requirements, organizational objectives, stakeholder expectations, and the organization's risk appetite.
Define 'Key Risk Indicators (KRIs)'
Metrics that provide an early indication of increasing risk exposures in different areas of the organization.
Define a 'risk owner'
An individual who is accountable for developing and implementing a risk response strategy for a risk documented in a risk register.
Define 'risk tolerance'
The maximum risk the organization is willing to take for a risk.
What is the difference between risk tolerance and risk appetite?
Risk appetite is what drives the willingness of the company to take risks. Risk tolerance then defines the boundaries and standards for assessing and responding to those risks.

What are the 3 levels of risk appetite?

  1. Expansionary

  2. Conservative

  3. Neutral

Define an expansionary risk appetite
Willingness to take on higher levels of risk in the pursuit of high returns or aggressive growth.
Define a conservative risk appetite
Prioritizes risk avoidance.
Define a neutral risk appetite
Balances expansionary and conservative approaches and is willing to take on risks if they align with strategic objectives and can be managed effectively.
Define 'risk reporting'
A summarized overview of known risks, realized risks, and their impact on the organization.
What is the purpose of risk reporting?
Supports decision-making, highlights concerns, and ensures stakeholders understand the organization's risks.
When assessing mission critical functions, what is an important component of advancing operations?
By reducing the number of dependencies between components.
How are dependencies between mission critical functions identified?
By performing a business process analysis (BPA) for each function.

What are the 5 factors to identify when performing a business process analysis (BPA) for a function/process?

  1. Inputs

  2. Outputs

  3. Process Flow

  4. Hardware

  5. Staff

What are business process inputs?
Sources of information for performing the function (including the impact if these are delayed or out of sequence).
What are business process outputs?
Data or resources produced by the function.
What are business process 'process flows'?
A step-by-step description of how the function is performed.
What defines business process hardware?
Server(s) or data center that performs the processing.
How does an organization's staff impact business processes
Needing sufficient staff and resources to support the function.