Professional Documents
Culture Documents
Cism Exam Preparation: Domain 2
Cism Exam Preparation: Domain 2
PREPARATION
Domain 2
1
Domain 2
Domain 2 (cont’d)
2
Domain Objectives
Domain 1:
Domain 4:
Information Security
Information Security
Governance, 24%
Incident
Management, 19%
Domain 3:
Information Security Domain 2:
Program Information Security
Development and Risk Management,
Management, 27% 30%
3
Defining Risk
Domain 2 Overview
4
Section One
Risk Identification
Task Statements
10
5
Knowledge Statements
11
Knowledge Statements
K2.6 Legal, regulatory, organizational and other requirements may influence risk
treatment decisions.
K2.7 Because the risk environment changes often, reliable and timely sources are
needed for effective risk management.
K2.8 A working knowledge of threats, vulnerability and exposure guides risk
treatment decisions as circumstances change over time.
12
6
Knowledge Statements
K2.16 Optimal risk treatment may require substantial planning to move from the
current state to the desired state.
13
Key Terms
Key Term Definition
Advanced persistent An adversary that possesses sophisticated levels of expertise and
threat significant resources which allow it to create opportunities to achieve its
objectives using multiple attack vectors (NIST SP800-61)
Probability The extent to which an event is likely to occur, measured by the ratio of
the favorable cases to the whole number of cases possible
Risk analysis The initial steps of risk management: analyzing the value of assets to the
business, identifying threats to those assets and evaluating how
vulnerable each asset is to those threats.
7
Key Terms
Key Term Definition
Risk appetite The amount of risk, on a broad level, that an entity is willing to accept in
pursuit of its mission
Risk assessment A process used to identify and evaluate risk and its potential effects.
Risk management The coordinated activities to direct and control an enterprise with regard
to risk
Risk profile An evaluation of an individual or organization's willingness to take risks,
as well as the threats to which an organization is exposed.
Risk scenario The tangible and assessable representation of risk
Risk tolerance The acceptable level of variation that management is willing to allow for
any particular risk as the enterprise pursues its objectives
Threat Anything (e.g., object, substance, human) that is capable of acting
against an asset in a manner that can result in harm.
Vulnerability A weakness in the design, implementation, operation or internal control
of a process that could expose the system to adverse threats from threat
events
15
16
8
Managing Risk
17
18
9
The Risk Assessment Process
Identification
Analysis
Evaluation
Risk treatment
19
20
10
Asset Identification
▪ In order to protect
something, you need to
identify it.
▪ Essential to managing risk
at an enterprise level
▪ Systems and data are
considered information
assets
21
Valuation of Assets
22
11
Valuation of Assets
Low
23
Discussion Question
24
12
Good to Know
25
Loss Scenarios
26
13
Loss Scenarios
27
Risk Assessment
28
14
FAIR
29
Threats
30
15
Threat Identification
▪ An absence of a threat
doesn’t mean the threat no
longer exists.
▪ New threats emerge as
behaviors change.
▪ Sources of threat data:
– Prior threat assessments
– News outlets
– External reports
– Official notices
– Industry publications
31
External Threats
Hardware Industrial
Fire Flooding Lost assets
flaws accidents
Power
Mechanical Seismic Severe
surge/utility Sabotage
failures activity storms
failure
Supply
Software
chain Terrorism Theft
errors
interruption
32
16
Advanced Persistent Threat
▪ Advanced = Method of gaining
access include multiple attack
vectors
▪ Persistent = An ability to remain
present in a network for a long time
without detection
▪ Threat = Anything that is capable of
acting against an asset in a manner
that can result in harm
▪ Often linked to nation-state actors,
activist groups or criminal
enterprises
33
34
17
Good to Know
35
Internal Threats
36
18
Types of Internal Threats
▪ Intentional
– Malicious
– Often disgruntled employees
– Control: Understand
frustrations/complaints and seek
to resolve them
– Control: Enforce SoD and least
privilege
▪ Unintentional
– Doing something they don’t
realize is a threat
– Providing information via social
engineering
– Control: Awareness training and
regular reviews
37
Vulnerabilities
38
19
Vulnerability Assessment
39
Vulnerability Areas
Network vulnerabilities
Physical access
Utilities
Supply chain
Processes
Equipment
Cloud computing
Internet of Things
40
20
Exposure
▪ Risk = Threats ×
Vulnerabilities ×
Consequences
▪ Exposure: The potential loss
to an area due to the
occurrence of an adverse
event.
41
Exposure Example
HIGH = 5
Threat event
LOW = 1
Threat
42
21
Exposure Example
MEDIUM-HIGH = 4
4 × 5 = 20 4×1=4
MEDIUM-HIGH LOW
43
Risk Scenarios
44
22
Risk Categorization
45
Risk Scenarios
46
23
The Risk Register
47
48
24
Section One
49
50
25
Section One
Practice Questions
Practice Question
52
26
Practice Question
53
Practice Question
54
27
Practice Question
55
Section Two
28
Task Statements
57
Knowledge Statements
K2.13 There are four ways to address risk, and it’s essential to know which approach
to use when, and why, because choosing the wrong treatment may lead to
excessive cost, fail to manage risk to tolerable levels or both.
K2.14 Controls are mechanisms used to mitigate, and it may be more cost effective
to employ known approaches rather than “reinventing the wheel.”
58
29
Knowledge Statements
K2.6 Legal, regulatory, organizational and other requirements may influence risk
treatment decisions.
K2.7 Because the risk environment changes often, reliable and timely sources are
needed for effective risk management.
K2.8 A working knowledge of threats, vulnerability and exposure guides risk
treatment decisions as circumstances change over time.
59
Knowledge Statements
K2.16 Optimal risk treatment require substantial planning to move from the current
state to a desired state.
K2.17 Risk management is most effective when it is built into business processes.
60
30
Key Terms
Risk acceptance If the risk is within the enterprise's risk tolerance or if the cost of
otherwise mitigating the risk is higher than the potential loss, the
enterprise can assume the risk and absorb any losses
Risk avoidance The process for systematically avoiding risk, constituting one approach
to managing risk
Risk mitigation The management of risk through the use of countermeasures and
controls
Risk transfer The process of assigning risk to another enterprise, usually through the
purchase of an insurance policy or by outsourcing the service
Risk treatment The process of selection and implementation of measures to modify risk
(ISO/IEC Guide 73:2002)
Calculating Risk
62
31
Good to Know
63
Risk Analysis
▪ Qualitative analysis:
– Based on category assignment (Low, Medium, High)
– Scales can be adjusted to suit circumstances
– Can be used:
• As an initial assessment
• To consider nontangible aspects of risk
• When there is a lack of adequate information
64
32
Risk Analysis
▪ Quantitative analysis
– Assigned numerical values
• Based on statistical probabilities and monetary values
– Quality depends on accuracy and validity
– Consequences may be expressed in terms of:
• Monetary Technical
• Operational
• Human impact criteria
65
Risk Analysis
▪ Semiquantitative analysis
66
33
Discussion Question
67
Activity
Using semiquantitative analysis, determine the relative value of the
following:
1. Reputational risk if a product line fails: The product development
team has indicated that the market is ready for this particular
product, but the infrastructure needed to launch the product is new
to the organization and has been rushed into production to meet
the desired launch date.
2. Noncompliance with new local regulation: Local government has
passed a new law mandating businesses operating within the
jurisdiction to update HVAC systems to more energy-efficient
models. The cost of upgrading the existing system would be US
$500,000, whereas the annual fine for noncompliance would be
$10,000.
3. Email quarantine system is outdated: The company’s email
quarantine system is outdated, and messages are not being
filtered as successfully as they had been in the past.
68
34
Activity: Scenario 1
69
Activity: Scenario 2
70
35
Activity: Scenario 3
71
Good To Know
72
36
Specialized Techniques
▪ Bayesian analysis
▪ Bow tie analysis
▪ Delphi method
▪ Event tree analysis
▪ Fault tree analysis
▪ Markov analysis
▪ Monte-Carlo analysis
73
Risk Evaluation
74
37
Risk Treatment
75
Good To Know
76
38
Risk Avoidance
77
Risk Transfer
78
39
Risk Mitigation
79
Risk Acceptance
80
40
Selecting a Risk Treatment Option
81
82
41
Discussion Question
83
Good to Know
84
42
Section Two
85
86
43
Section Two
Practice Questions
Practice Question
88
44
Practice Question
A. Cost-benefit analysis
B. Penetration testing
C. Frequent risk assessment programs
D. Annual loss expectancy calculation
89
Practice Question
A. an intrinsic risk.
B. a systemic risk.
C. a residual risk.
D. an operational risk.
90
45
Practice Question
91
Section Three
46
Task Statements
▪ T2.6 Facilitate the integration of information risk management into
business and IT processes (e.g., systems development,
procurement, project management) to enable a consistent and
comprehensive information risk management program across the
organization.
▪ T2.7 Monitor for internal and external factors (e.g., threat
landscape, cybersecurity, geopolitical, regulatory change) that may
require reassessment of risk to ensure that changes to existing, or
new, risk scenarios are identified and managed appropriately.
▪ T2.8 Report noncompliance and other changes in information risk
to facilitate the risk management decision-making process.
▪ T2.9 Ensure that information security risk is reported to senior
management to support an understanding of potential impact on
the organizational goals and objectives.
93
Knowledge Statements
94
47
Knowledge Statements
K2.13 There are four ways to address risk, and it’s essential to know which approach
to use when, and why, because choosing the wrong treatment may lead to
excessive cost, fail to manage risk to tolerable levels, or both.
K2.17 Risk management is most effective when it is built into business processes.
K2.18 Timelines and content of risk reports are often driven by explicit compliance
standards.
95
Key Terms
Key risk indicator A subset of risk indicators that are highly relevant and possess a high probability of
predicting or indicating important risk.
Maximum allowable The absolute longest amount of time that the system can be unavailable without
downtown direct or indirect ramifications to the organization.
Maximum tolerable Maximum time that an enterprise can support processing in alternate mode.
outage
Service delivery Directly related to the business needs, SDO is the level of services to be reached
objective during the alternate process mode until the normal situation is restored.
Recovery point objective Determined based on the acceptable data loss in case of a disruption of operations.
It indicates the earliest point in time that is acceptable to recover the data. The RPO
effectively quantifies the permissible amount of data loss in case of interruption.
Recovery time objective The amount of time allowed for the recovery of a business function or resource after
a disaster occurs.
96
48
Life Cycle Integration
97
Security Baselines
98
49
Volatility
99
100
50
Key Risk Indicators
101
▪ Impact
▪ Effort
– To implement
– To measure
– To report
▪ Reliability
▪ Sensitivity
102
51
Criteria for KRIs
103
104
52
Discussion Question
105
106
53
Continuity and Risk
107
108
54
Considerations for Risk Reporting
▪ Reports should be
tailored to the intended
audience
▪ Use categories like
“HIGH,” “MEDIUM,”
“LOW.”
▪ Use data to back up
rationale.
▪ The information security
manager is responsible
for information risk.
109
Escalation
110
55
Section Three
111
112
56
Section Three
Practice Questions
Practice Question
114
57
Practice Question
115
Practice Question
58
Practice Question
117
Domain 2
Summary
59
Summary
119
Summary
120
60
Questions
121
61