Cybersecurity: Module 4

The process of identifying risk, assessing its relative magnitude, and taking steps to reduce it to an acceptable level.

The identification, analysis, and evaluation of risk as initial parts of risk management.

The application of safeguards or controls to reduce the risks to an organization’s information assets to an acceptable level.

The overall structure of the strategic planning and design for the entirety of the organization’s RM efforts.

The identification, analysis, evaluation, and treatment of risk to information assets, as specified in the RM framework.

A document that contains specifications for the implementation and conduct of RM efforts.

The risk to information assets that remains even after current controls have been applied.

The quantity and nature of risk that organizations are willing to accept as they evaluate the trade-offs between perfect security and unlimited accessibility.

The assessment of the amount of risk an organization is willing to accept for a particular information asset, typically synthesized into the organization’s overall risk appetite.

An extreme level of risk tolerance whereby the organization is unwilling to allow any successful attacks or suffer any loss to an information asset.

A formal document developed by the organization that specifies its overall willingness to accept risk to its information assets, based on a synthesis of individual risk tolerances.

The recognition, enumeration, and documentation of risks to an organization’s information assets.

A formal access control methodology used to assign a level of confidentiality to an information asset and thus restrict the number of people who can access it.

An evaluation of the threats to information assets, including a determination of their likelihood of occurrence and potential impact of an attack.

A determination of the extent to which an organization’s information assets are exposed to risk.

The probability that a specific vulnerability within an organization will be attacked by a threat.

An understanding of the potential consequences of a successful attack on an information asset by a threat.

The state of having limited or imperfect knowledge of a situation, making it less likely that organizations can successfully anticipate future events or outcomes.

The process of comparing an information asset’s risk rating to the numerical representation of the organization’s risk appetite or risk threshold to determine if risk treatment is required.

The risk treatment strategy that attempts to eliminate or reduce any remaining uncontrolled risk through the application of additional controls and safeguards in an effort to change the likelihood of a successful attack on an information asset

The risk treatment strategy that attempts to shift risk to other assets, processes, or organizations.

The risk treatment strategy that indicates the organization is willing to accept the current level of residual risk and, as a result, the organization makes a conscious decision to do nothing else to protect an information asset from risk and to “live with” the outcome from any resulting exploitation.

The risk treatment strategy that eliminates all risk associated with an information asset by removing it from service.

The necessary information flow within and between the governance group, RM framework team, and RM process team during the implementation of RM.

The data collection and feedback associated with performance measures used during the conduct of the process.

The financial savings from using the mitigation risk treatment strategy to implement a control and eliminate the financial ramifications of an incident.

The formal assessment and presentation of the economic expenditures needed for a particular security control, contrasted with its projected value to the organization

The process of assigning financial value or worth to each information asset.

In a cost-benefit analysis, the calculated value associated with the most likely loss from an attack (impact)

In a cost-benefit analysis, the expected frequency of an attack, expressed on a per-year basis.

In a cost-benefit analysis, the product of the annualized rate of occurrence and single loss expectancy.