How should a risk be HANDLED when the cost of the countermeasure OUTWEIGHS the cost of the risk?
Answer(s): C
Which means the company understands the level of risk it is faced.The following answers are incorrect because :Reject the risk is incorrect as it means ignoring the risk which is dangerous. Perform another risk analysis is also incorrect as the existing risk analysis has already shown the results.Reduce the risk is incorrect is applicable after implementing the countermeasures. Reference : Shon Harris AIO v3 , Chapter-3: Security Management Practices , Page : 39
What would BEST define risk management?
This is the basic process of risk management.Risk is the possibility of damage happening and the ramifications of such damage should it occur. Information risk management (IRM) is the process of identifying and assessing risk, reducing it to an acceptable level, and implementing the right mechanisms to maintain that level. There is no such thing as a 100 percent secure environment. Every environment has vulnerabilities and threats to a certain degree.The skill is in identifying these threats, assessing the probability of them actually occurring and the damage they could cause, and then taking the right steps to reduce the overall level of risk in the environment to what the organization identifies as acceptable.Proper risk management requires a strong commitment from senior management, a documented process that supports the organization's mission, an information risk management (IRM) policy and a delegated IRM team. Once you've identified your company's acceptable level of risk, you need to develop an information risk management policy.The IRM policy should be a subset of the organization's overall risk management policy (risks to a company include more than just information security issues) and should be mapped to the organizational security policies, which lay out the acceptable risk and the role of security as a whole in the organization. The IRM policy is focused on risk management while the security policy is very high-level and addresses all aspects of security. The IRM policy should address the following items:Objectives of IRM teamLevel of risk the company will accept and what is considered an acceptable risk (as defined in the previous article)Formal processes of risk identificationConnection between the IRM policy and the organization's strategic planning processes Responsibilities that fall under IRM and the roles that are to fulfill them Mapping of risk to internal controlsApproach for changing staff behaviors and resource allocation in response to risk analysis Mapping of risks to performance targets and budgetsKey indicators to monitor the effectiveness of controlsShon Harris provides a 10,000-foot view of the risk management process below:A big question that companies have to deal with is, "What is enough security?" This can be restated as, "What is our acceptable risk level?" These two questions have an inverse relationship. You can't know what constitutes enough security unless you know your necessary baseline risk level.To set an enterprise-wide acceptable risk level for a company, a few things need to be investigated and understood. A company must understand its federal and state legal requirements, its regulatory requirements, its business drivers and objectives, and it must carry out a risk and threat analysis. (I will dig deeper into formalized risk analysis processes in a later article, but for now we will take a broad approach.) The result of these findings is then used to define the company's acceptable risk level, which is then outlined in security policies, standards, guidelines and procedures.Although there are different methodologies for enterprise risk management, the core components of any risk analysis is made up of the following:Identify company assetsAssign a value to each assetIdentify each asset's vulnerabilities and associated threats Calculate the risk for the identified assetsOnce these steps are finished, then the risk analysis team can identify the necessary countermeasures to mitigate the calculated risks, carry out cost/benefit analysis for these countermeasures and report to senior management their findings.When we look at information security, there are several types of risk a corporation needs to be aware of and address properly. The following items touch on the major categories:Physical damage Fire, water, vandalism, power loss, and natural disastersHuman interaction Accidental or intentional action or inaction that can disrupt productivityEquipment malfunction Failure of systems and peripheral devicesInside and outside attacks Hacking, cracking, and attackingMisuse of data Sharing trade secrets, fraud, espionage, and theftLoss of data Intentional or unintentional loss of information through destructive meansApplication error Computation errors, input errors, and buffer overflowsThe following answers are incorrect:The process of eliminating the risk is not the best answer as risk cannot be totally eliminated.The process of assessing the risks is also not the best answer.The process of transferring risk is also not the best answer and is one of the ways of handling a risk after a risk analysis has been performed.
Shon Harris , AIO v3 , Chapter 3: Security Management Practices , Page: 66-68 andhttp://searchsecurity.techtarget.com/tip/Understanding-risk
What is the highest amount a company should spend annually on countermeasures for protectingan asset valued at $1,000,000 from a threat that has an annualized rate of occurrence (ARO) of once every five years and an exposure factor (EF) of 30%?
The cost of a countermeasure should not be greater in cost than the risk it mitigates (ALE). For a quantitative risk assessment, the equation is ALE = ARO x SLE where the SLE is calculated as the product of asset value x exposure factor. An event that happen once every five years would have an ARO of .2 (1 divided by 5).SLE = Asset Value (AV) x Exposure Fact (EF)SLE = 1,000,000 x .30 = 300,000ALE = SLE x Annualized Rate of Occurance (ARO)ALE = 300,000 x .2 = 60,000Know your acronyms:ALE -- Annual loss expectancyARO -- Annual rate of occurrenceSLE -- Single loss expectancyThe following are incorrect answers:$300,000 is incorrect. See the explanation of the correct answer for the correct calculation. $150,000 is incorrect. See the explanation of the correct answer for the correct calculation. $1,500 is incorrect. See the explanation of the correct answer for the correct calculation.
Mc Graw Hill, Shon Harris, CISSP All In One (AIO) book, Sixth Edition , Pages 87-88 andOfficial ISC2 Guide to the CISSP Exam, (OIG), Pages 60-61
Which of the following statements pertaining to quantitative risk analysis is false?
Answer(s): D
Assigning the values for the inputs to a purely quantitative risk assessment requires both a lot of time and significant experience on the part of the assessors. The most experienced employees or representatives from each of the departments would be involved in the process. It is NOT an easy task if you wish to come up with accurate values."It can be automated" is incorrect. There are a number of tools on the market that automate the process of conducting a quantitative risk assessment."It involves complex calculations" is incorrect. The calculations are simple for basic scenarios but could become fairly complex for large cases. The formulas have to be applied correctly."It requires a high volume of information" is incorrect. Large amounts of information are required in order to develop reasonable and defensible values for the inputs to the quantitative risk assessment.
CBK, pp. 60-61AIO3, p. 73, 78The Cissp Prep Guide - Mastering The Ten Domains Of Computer Security - 2001, page 24
Notifying the appropriate parties to take action in order to determine the extent of the severity of an incident and to remediate the incident's effects is part of:
These are core functions of the incident response process."Incident Evaluation" is incorrect. Evaluation of the extent and cause of the incident is a component of the incident response process."Incident Recognition" is incorrect. Recognition that an incident has occurred is the precursor to the initiation of the incident response process."Incident Protection" is incorrect. This is an almost-right-sounding nonsense answer to distract the unwary.ReferencesCBK, pp. 698 - 703
Post your Comments and Discuss ISC SSCP exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the SSCP content, but please register or login to continue.