Scenario:The risk assessment process was led by Henry, Bontton's risk manager. The first step that Henry took was identifying the company's assets. Afterward, Henry created various potential incident scenarios. One of the main concerns regarding the use of the application was the possibility of being targeted by cyber attackers, as a great number of organizations were experiencing cyberattacks during that time. After analyzing the identified risks, Henry evaluated them and concluded that new controls must be implemented if the company wants to use the application. Among others, he stated that training should be provided to personnel regarding the use of the application and that awareness sessions should be conducted regarding the importance of protecting customers' personal data. Lastly, Henry communicated the risk assessment results to the top management. They decided that the application will be used only after treating the identified risks. Henry concluded that one of the main concerns regarding the use of the application for online ordering was cyberattacks.What did Henry identify in this case? Refer to scenario 1.\
Answer(s): A
In this scenario, Henry identifies "cyberattacks" as one of the main concerns related to the use of the application for online ordering. According to ISO/IEC 27005, a "threat" is any potential cause of an unwanted incident that may result in harm to a system or organization. In this context, cyberattacks are considered a threat because they represent a potential cause that could compromise the security of the application. Henry's identification of cyberattacks as a primary concern aligns with recognizing a specific threat that could exploit vulnerabilities within the system.
ISO/IEC 27005:2018, Clause 8.3, "Threat identification," which provides guidance on identifying threats that could affect the organization's information assets. ISO/IEC 27001:2013, Clause 6.1.2, "Information Security Risk Assessment," where identifying threats is part of the risk assessment process.These answers are verified based on the standards' definitions and guidelines, providing a comprehensive understanding of how ISO/IEC 27005 is used within the context of ISO/IEC 27001.
Scenario:The risk assessment process was led by Henry, Bontton's risk manager. The first step that Henry took was identifying the company's assets. Afterward, Henry created various potential incident scenarios. One of the main concerns regarding the use of the application was the possibility of being targeted by cyber attackers, as a great number of organizations were experiencing cyberattacks during that time. After analyzing the identified risks, Henry evaluated them and concluded that new controls must be implemented if the company wants to use the application. Among others, he stated that training should be provided to personnel regarding the use of the application and that awareness sessions should be conducted regarding the importance of protecting customers' personal data. Lastly, Henry communicated the risk assessment results to the top management. They decided that the application will be used only after treating the identified risks. According to scenario 1, Bontton wanted to use an application that ensures only authorized users have access to customers' personal data.Which information security principle does Bontton want to ensure in this case?
Answer(s): C
In the context of information security, confidentiality refers to ensuring that information is accessible only to those who are authorized to have access. According to scenario 1, Bontton wanted to use an application that ensures only authorized users have access to customers' personal data. This directly aligns with the principle of confidentiality, as Bontton aims to protect personal data from unauthorized access or disclosure. This focus on restricting access to sensitive data to authorized personnel clearly indicates that the confidentiality of information is the primary concern in this case.Thus, the correct answer is C.
According to ISO/IEC 27000, what is the definition of information security?
According to ISO/IEC 27000, information security is defined as the "preservation of confidentiality, integrity, and availability of information." This definition highlights the three core principles of information security:Confidentiality ensures that information is not disclosed to unauthorized individuals or systems. Integrity ensures the accuracy and completeness of information and its processing methods. Availability ensures that authorized users have access to information and associated assets when required.This definition encompasses the protection of information in all forms and aligns with ISO/IEC 27005's guidelines on managing information security risks. Therefore, option A is the correct answer. Options B and C are incorrect as they refer to more specific aspects or other areas of information management.
Which statement regarding risks and opportunities is correct?
Answer(s): B
ISO standards, including ISO/IEC 27005, make a distinction between risks and opportunities. Risks are defined as the effect of uncertainty on objectives, which can result in negative consequences (such as financial loss, reputational damage, or operational disruption). Opportunities, on the other hand, are situations or conditions that have the potential to provide a positive impact on achieving objectives. Therefore, option B is correct, as it accurately reflects that risks are generally associated with negative impacts, while opportunities can lead to positive outcomes. Option A is incorrect because risks can have negative outcomes, not positive ones. Option C is incorrect because risks and opportunities have different meanings and implications and are not interchangeable.
Which of the following risk assessment methods provides an information security risk assessment methodology and involves three phases build asset-based threat profiles, identify infrastructure vulnerabilities, and develop security strategy and plans?
OCTAVE-S (Operationally Critical Threat, Asset, and Vulnerability Evaluation for Small Organizations) is a risk assessment methodology tailored for small organizations. It provides a structured approach for identifying and managing information security risks. The OCTAVE-S method involves three main phases:Building asset-based threat profiles, where critical assets and their associated threats are identified. Identifying infrastructure vulnerabilities by assessing the organization's technological infrastructure for weaknesses that could be exploited by threats.Developing security strategy and plans to address the identified risks and improve the overall security posture.The OCTAVE-S method aligns with the description provided in the question, making it the correct answer. MEHARI and TRA are other risk assessment methods, but they do not specifically follow the three phases outlined above.
Post your Comments and Discuss PECB Risk Manager exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the Risk Manager content, but please register or login to continue.