-
Key Terms & Concepts
-
Risk:
- the possibility of a malicious attack or other threat causing damage or downtime to a computer system.
-
Risk Management:
- The identification, assessment, and prioritization of risks, and the mitigating and monitoring of those risks.
-
Information Assurance (IA):
- A term used to refer to risk management, when referring to risk that specifically concerns computer hardware and software.
-
Organizations usually employ one (or more) of four general strategies when managing a known risk:
-
Risk Transference (Risk Sharing)
- The transfer or outsourcing of risk to a third party.
-
Risk Avoidance
- When an organization avoids risk because the risk factor is too great.
-
Risk Reduction
- When an organization mitigates risk to an acceptable level.
-
Risk Acceptance
- The amount of risk an organization is willing to accept. Also known as risk retention.
-
Residual Risk:
- The risk that is left over after a security plan and a disaster recovery plan have been implemented.
-
Generally, risk assessment follows this four-step order:
- Identify the organization's assets.
- Identify vulnerabilities to those assets.
- Identify threats to assets, and the likelihood of those threats.
-
Qualitatively and/or quantitatively assess the impact of the identified threats and vulnerabilities on your organization, and develop a security policy that best spends your limited resources to secure your most important assets.
-
Qualitative Risk Assessment:
- An assessment that assigns numeric values to the probability of a risk and the impact it can have on the system or network.
-
Quantitative Risk Assessment:
- An assessment that measures risk by using exact monetary values.
-
Risk Register:
- Also known as a risk log.
- Helps to track issues and address problems as they occur.
-
Risk Mitigation:
- When a risk is reduced or eliminated altogether.
- Qualitative Risk Assessment
-
Quantitative Risk Assessment
-
List the three values used when calculating the quantitative risk to an asset:
-
Single Loss Expectancy (SLE):
- The dollar loss of value caused by a single incident to an asset.
-
Annualized Rate of Occurrence (ARO):
- The number of times per year that the specific incident might occur.
-
Mean Time Between Failures (MTBF):
- Defines the average number of failures per million hours for a product in question.
- Explain the terms Failure in Time (FIT), Mean Time to Repair (MTTR), and Mean Time to Failure (MTTF):
- Failure in Time (FIT):
- Similar to MTBF, another term used to define the average number of failures for a specific product or asset, but instead using a scale in billions (not millions).
- Mean Time to Repair (MTTR):
- The average time needed to repair a failed device
- Mean Time to Failure (MTTF):
- A basic measure of reliability for devices that cannot be repaired once they break
- All three of these values should be considered when creating a Disaster Recovery (DR) plan.
-
Annualized Loss Expectancy (ALE):
- The total annual dollar loss to an asset because of a specific type of incident.
-
Calculated as:
- ALE = SLE × ARO