Professional Documents
Culture Documents
CISM 15e Domain 2
CISM 15e Domain 2
DOMAIN 2
INFORMATION RISK MANAGEMENT
DOMAIN 2
Domain 1:
Domain 4:
Information
Information Security
Security
Incident
Governance, 24%
Management, 19%
Domain 3:
Information Security Domain 2:
Program Information Security
Development and Risk Management,
Management, 27% 30%
DEFINING RISK
T2.1 Establish and/or maintain a process for information asset classification to ensure
that measures taken to protect assets are proportional to their business value
T2.2 Identify legal, regulatory, organizational and other applicable requirements to
manage the risk of noncompliance to acceptable levels
T2.3 Ensure that risk assessments, vulnerability assessments and threat analyses are
conducted consistently, and at the appropriate times, to identify and assess risk to the
organization’s information
KNOWLEDGE STATEMENTS
How does Section One relate to each of the following knowledge statements?
Knowledge Connection
Statement
How does Section One relate to each of the following knowledge statements?
Knowledge Connection
Statement
How does Section One relate to each of the following knowledge statements?
Knowledge Connection
Statement
Advanced persistent threat An adversary that possesses sophisticated levels of expertise and significant resources
which allow it to create opportunities to achieve its objectives using multiple attack vectors
(NIST SP800-61)
Probability The extent to which an event is likely to occur, measured by the ratio of the favorable cases
to the whole number of cases possible
Risk analysis The initial steps of risk management: analyzing the value of assets to the business,
identifying threats to those assets and evaluating how vulnerable each asset is to those
threats.
See www.isaca.org/glossary for more key terms.
KEY TERMS
Risk appetite The amount of risk, on a broad level, that an entity is willing to accept in pursuit of its
mission
Risk assessment A process used to identify and evaluate risk and its potential effects.
Risk management The coordinated activities to direct and control an enterprise with regard to risk
Risk profile An evaluation of an individual or organization's willingness to take risks, as well as the
threats to which an organization is exposed.
Risk scenario The tangible and assessable representation of risk
Risk tolerance The acceptable level of variation that management is willing to allow for any particular risk
as the enterprise pursues its objectives
Threat Anything (e.g., object, substance, human) that is capable of acting against an asset in a
manner that can result in harm.
Vulnerability A weakness in the design, implementation, operation or internal control of a process that
could expose the system to adverse threats from threat events
IMPACT DRIVES RISK
Determine
Ensure asset objectives
identification,
Define classification
authority, and
structure and ownership
Define reporting
scope and
charter
Establish
context
and
purpose
THE RISK ASSESSMENT PROCESS
Identification
Analysis
Evaluation
Risk treatment
COBIT 5 RISK MANAGEMENT PROCESS
ASSET IDENTIFICATION
In order to protect
something, you need to
identify it.
VALUATION OF ASSETS
Low
DISCUSSION QUESTION
The next step is considering the probability of loss occurring. Note: Information
security managers
Requires knowledge of the threat environment and the should have broad
vulnerability of the information assets knowledge of various
methodologies to
Structured methodologies can help to direct the process. determine the most
suitable approach for
their organization.
Specific approaches
will not be tested in the
CISM examination.
FAIR
THREATS
Disease
Criminal acts Data corruption Espionage Facility flaws
(epidemics)
Industrial
Fire Flooding Hardware flaws Lost assets
accidents
Power
Mechanical
surge/utility Sabotage Seismic activity Severe storms
failures
failure
Supply chain
Software errors Terrorism Theft
interruption
ADVANCED PERSISTENT THREAT
Advanced
Persistent
Threat
Complete Establish
mission foothold
Maintain Escalate
presence privileges
Internal
Move laterally
reconnaissance
GOOD TO KNOW
• Malicious
• Often disgruntled employees
Intentional • Control: Understand frustrations/complaints and seek to
resolve them
• Control: Enforce SoD and least privilege
Vulnerability
• A weakness in the design, implementation, operation or internal control of a process that could
expose the system to adverse threats from threat events
Network vulnerabilities
Physical access
Utilities
Supply chain
Processes
Equipment
Cloud computing
Internet of Things
EXPOSURE
Its origin
Its
Protective consequences,
controls results or
impact
A specific
reason for its
occurrence
RISK SCENARIOS
THE RISK REGISTER
Risk Identification
• In order to manage risk, you must first identify what risk the
organization faces.
• Understanding concepts such as threat, vulnerability, exposure and
likelihood can help you to prioritize risk management efforts.
• Risk is ever-changing, so risk identification is not a one-time effort.
SECTION ONE
PRACTICE QUESTIONS
PRACTICE QUESTION
How does Section Two relate to each of the following knowledge statements?
Knowledge Connection
Statement
K2.13 There are four ways to address risk, and it’s essential to know which
approach to use when, and why, because choosing the wrong treatment
may lead to excessive cost, fail to manage risk to tolerable levels or
both.
K2.14 Controls are mechanisms used to mitigate, and it may be more cost
effective to employ known approaches rather than “reinventing the
wheel.”
KNOWLEDGE STATEMENTS
How does Section Two relate to each of the following knowledge statements?
Knowledge Connection
Statement
How does Section Two relate to each of the following knowledge statements?
Knowledge Connection
Statement
K2.16 Optimal risk treatment require substantial planning to move from the
current state to a desired state.
K2.17 Risk management is most effective when it is built into business
processes.
K2.19 Risk recommendations may require business justification.
KEY TERMS
Risk acceptance If the risk is within the enterprise's risk tolerance or if the cost of otherwise mitigating the risk
is higher than the potential loss, the enterprise can assume the risk and absorb any losses
Risk avoidance The process for systematically avoiding risk, constituting one approach to managing risk
Risk mitigation The management of risk through the use of countermeasures and controls
Risk transfer The process of assigning risk to another enterprise, usually through the purchase of an
insurance policy or by outsourcing the service
Risk treatment The process of selection and implementation of measures to modify risk (ISO/IEC Guide
73:2002)
Qualitative analysis:
• Based on category assignment (Low, Medium, High)
• Scales can be adjusted to suit circumstances
• Can be used:
• As an initial assessment
• To consider nontangible aspects of risk
• When there is a lack of adequate information
RISK ANALYSIS
Quantitative analysis
• Assigned numerical values
• Based on statistical probabilities and monetary values
• Quality depends on accuracy and validity
• Consequences may be expressed in terms of:
• Monetary Technical
• Operational
• Human impact criteria
RISK ANALYSIS
Semiquantitative analysis
DISCUSSION QUESTION
Bayesian
analysis
Markov
Delphi method
analysis
Insurance policies and service level agreements are risk transfer mechanisms.
Organizations always retain some responsibility for consequences of compromise.
Generally, risk is transferred when likelihood is low, but impact is high.
RISK MITIGATION
No additional action
is taken.
• Risk treatment decisions are based on the lowest cost that meets
business goals.
SECTION TWO
PRACTICE QUESTIONS
PRACTICE QUESTION
A. Cost-benefit analysis
B. Penetration testing
C. Frequent risk assessment programs
D. Annual loss expectancy calculation
PRACTICE QUESTION
A. an intrinsic risk.
B. a systemic risk.
C. a residual risk.
D. an operational risk.
PRACTICE QUESTION
T2.6 Facilitate the integration of information risk management into business and IT
processes (e.g., systems development, procurement, project management) to enable a
consistent and comprehensive information risk management program across the
organization.
T2.7 Monitor for internal and external factors (e.g., threat landscape, cybersecurity,
geopolitical, regulatory change) that may require reassessment of risk to ensure that
changes to existing, or new, risk scenarios are identified and managed appropriately.
T2.8 Report noncompliance and other changes in information risk to facilitate the risk
management decision-making process.
T2.9 Ensure that information security risk is reported to senior management to support an
understanding of potential impact on the organizational goals and objectives.
KNOWLEDGE STATEMENTS
How does Section Three relate to each of the following knowledge statements?
Knowledge Connection
Statement
How does Section Three relate to each of the following knowledge statements?
Knowledge Connection
Statement
K2.13 There are four ways to address risk, and it’s essential to know which
approach to use when, and why, because choosing the wrong treatment
may lead to excessive cost, fail to manage risk to tolerable levels, or
both.
K2.17 Risk management is most effective when it is built into business
processes.
K2.18 Timelines and content of risk reports are often driven by explicit
compliance standards.
KEY TERMS
Allowable interruption window The longest that operations can be interrupted before financial impacts threaten the organization’s
continued existence.
Key risk indicator A subset of risk indicators that are highly relevant and possess a high probability of predicting or indicating
important risk.
Maximum allowable downtime The absolute longest amount of time that the system can be unavailable without direct or indirect
ramifications to the organization.
Maximum tolerable outage Maximum time that an enterprise can support processing in alternate mode.
Service delivery objective Directly related to the business needs, SDO is the level of services to be reached during the alternate
process mode until the normal situation is restored.
Recovery point objective Determined based on the acceptable data loss in case of a disruption of operations. It indicates the
earliest point in time that is acceptable to recover the data. The RPO effectively quantifies the permissible
amount of data loss in case of interruption.
Recovery time objective The amount of time allowed for the recovery of a business function or resource after a disaster occurs.
LIFE CYCLE INTEGRATION
Integration with life cycle processes leads to more effective risk management.
Change management should include consideration of risk.
• Should extend beyond hardware and software
• Should include review of the risk register
• Should include information security representative
SECURITY BASELINES
Vulnerabilities identified publically may encourage threat actors to try to exploit them
before organizations can patch them.
Patching is vital, but moving too fast can also introduce new weaknesses.
KEY RISK INDICATORS
Impact
Effort
• To implement
• To measure
• To report
Reliability
Sensitivity
CRITERIA FOR KRIS
Service Maximum
delivery tolerable
objectives outage
Allowable
interruption
window
RISK REPORTING AND CONVERGENCE
Business operations are managed by considering the effects of risk upon goals.
Risk reporting used to be segregated by risk type.
• New initiatives to consolidate risk reporting
• Due to the fact that risk in one area can cascade to another
CONSIDERATIONS FOR RISK
REPORTING
Reports should be tailored to the intended audience
Use categories like “HIGH,” “MEDIUM,” “LOW.”
Use data to back up rationale.
The information security manager is responsible for
information risk.
ESCALATION