How can we help?

You can also find more resources in our Help Center.

25 terms

Risk Management

Chapter 4- Principles of Information Security 4th Ed.
STUDY
PLAY
Risk control
_____ is the application of controls to reduce the risks to an organization's data and information systems.
competitive disadvantage
The concept of _____ refers to falling behind the competition.
Risk identification
The first phase of risk management is _____.
MAC addresses
_____ are sometimes called electronic serial numbers or hardware addresses.
data classification scheme
Many corporations use a _____ to help secure the confidentiality and integrity of information.
FCO
A _____ is an authorization issued by an organization for the repair, modification, or update of a piece of equipment.
five
The military uses a _____-level classification scheme.
confidential
In the U.S. military classification scheme, _____ data is any information or material the unauthorized disclosure of which reasonably could be expected to cause damage to the national security.
distribution
portability
destruction
ALL OF THE ABOVE
Management of classified data includes its storage and _____.
dumpster diving
There are individuals who search trash and recycling - a practice known as _____ -to retrieve information that could embarrass a company or compromise information security.
weighted factor analysis
In a _____, each information asset is assigned a score for each of a set of assigned critical factor.
Risk
_____ equals likelihood of vulnerability occurrence times value (or impact) minus percentage risk already controlled plus an element of uncertainty.
general
The ____ security policy is an executive-level document that outlines the organization's approach and attitude towards information security and relates the strategic value of information security within the organization.
program
The ____ security policy is a planning document that outlines the process of implementing security in the organization.
System-specific
_____ policies address the particular use of certain systems.
defend control
The _____ strategy attempts to prevent the exploitation of the vulnerability.
transfer control
The _____ strategy attempts to shift risk to other assets, other processes, or other organizations.
IR
The actions an organization can and perhaps should take while an incident is in progress should be specified in a document called the _____ plan.
DR
_____ plans usually include all preparations for the recovery process, strategies to limit losses during the disaster, and detailed steps to follow when the smoke clears, the dust settles, or the floodwaters recede.
accept control
The _____ strategy is the choice to do nothing to protect a vulnerability and to accept the outcome of its exploitation.
CBA
The formal decision making process used when considering the economic feasibility of implementing information security controls and safeguards is called a _____.
ARO
_____ is simply how often you expect a specific type of attack to occur.
standard of due care
When organizations adopt levels of security for a legal defense, they may need to show that they have done what any prudent organization would do in similar circumstances. This is referred to as a _____.
Operational
_____ feasibility analysis examines user acceptance and support, management acceptance and support, and the overall requirements of the organization's stakeholders.
Risk appetite
_____ defines the quantity and nature of risk that organizations are willing to accept as they evaluate the tradeoffs between perfect security and unlimited accessibility.