Angelia Paul Management of Information Security Mehmet Kilinc November 11, 2011 Chapter 8 Review Questions (Odd) 1.

What is risk management? The process of assessing the risks to an organizations information and determining how those risks can be controlled or mitigated Why is identification of risks, through a listing of assets and their vulnerabilities, so important to the risk management process? An organization needs to assess the value of its assets and understand the potential losses if those assets are compromised. Who is responsible for risk management in an organization? Management, Information Security and Information Technology Which community of interest usually provides the resources used when undertaking information asset risk management? Information security usually takes a leadership role, because they understand the threats and attacks that introduce risk. Why do networking components need more examination from an information security perspective than from a systems development perspective? Networking components are often the focal point of attacks against the an organization. Which information attributes are seldom or never applied to software elements? IP Address, Mac Address, Manufacturers model or part number, physical location When you document procedures, why is it useful to know where the electronic versions are stored? Authorized users must be able to easily locate documents; these documents are not static and must be updated regularly. They also need to be readily retrieved in the event systems become unavailable. What is the difference between an assets ability to generate revenue and its ability to generate profit?

3.

5. 7.

9.

11.

13.

15.

Assets that generate revenue are critical to an organizations survival; however, not every asset that generates revenue is profitable after expenses associated with the revenue are paid 17. How many threat categories are listed in this chapter? Which do think is the most common and why? Twelve. The most common if often noted as human error because it is the hardest to control. Describe the TVA worksheet. What is it used for? It is a starting point for risk assessment. A worksheet that combines a prioritized list of assets and their vulnerabilities and a list prioritizing threats facing the organization. The resulting grid provides a convenient method of examining the exposure of assets, allowing a simplistic vulnerability assessment.

19.