Risk assessment and analysis, governance, third-party risk, compliance, audits and security awareness.
39 cards · basic cards · AI-written, checked twice. Edit anything.
- What is the formula for calculating risk?
Show answer
Risk = Likelihood × Impact- Define inherent risk
Show answer
The level of risk before any controls or mitigation measures are applied- Define residual risk
Show answer
The amount of risk remaining after control measures have been implemented- What is qualitative risk analysis?
Show answer
Risk assessment using subjective judgment, descriptive scales (high, medium, low) and expert opinion rather than numerical data- What is quantitative risk analysis?
Show answer
Risk assessment using numerical data, probabilities and monetary values to calculate exact risk levels- What does SLE stand for and measure?
Show answer
Single Loss Expectancy; the monetary value lost if a threat occurs one time- What does ALE stand for and measure?
Show answer
Annualized Loss Expectancy; the expected total loss from a threat over one year- What does ARO stand for and measure?
Show answer
Annualized Rate of Occurrence; the number of times a threat is expected to occur in one year- What is the relationship between SLE, ARO and ALE?
Show answer
ALE = SLE × ARO- What is CVSS?
Show answer
Common Vulnerability Scoring System; a standardized method for rating the severity of security vulnerabilities- What is threat modeling?
Show answer
A process of identifying potential threats, vulnerabilities and attack vectors to an asset or system- What is a risk matrix or heat map?
Show answer
A visual tool that plots threats on axes of probability and impact to prioritize risks- Define risk tolerance
Show answer
The amount of risk an organization is willing to accept in the pursuit of its business objectives- What is risk mitigation?
Show answer
Implementing controls and measures to reduce the likelihood or impact of a risk to an acceptable level- What is risk acceptance?
Show answer
The decision to acknowledge a risk and accept the potential consequences rather than implement controls
FlashKeepers