CYS403 · Chapter 1 · Annotated SlidesSecurity Risk Management, Governance and Control
Original
Overview

Security Risk Management, Governance and Control

Why cyber risk matters to the business, IT risk vs. IT value (Risk IT, Val IT, COBIT), the CIA triad, business-driven security, cybersecurity management and governance, security blueprints, the policy hierarchy (policies, standards, procedures, baselines, guidelines) and planning horizons.

How to read this page

Every original slide is shown unchanged. Yellow marks on a slide point to a numbered note: hover or tap a mark to jump to its note, and hover a note to see its marks. Questions tagged Past exam appeared on a real paper; Prediction questions are likely angles, not confirmed. Pick an answer to each question: a wrong pick tells you why it is wrong, so you can try again.

All 34 slides
  1. 1 Slide 1
  2. 2 Intended Learning Outcomes
  3. 3 Agenda
  4. 4 Risks in Business
  5. 5 Why Care About Cyber Risk?
  6. 6 Why Care About Cyber Risk?
  7. 7 Why Care About Cyber Risk?
  8. 8 Manage and Capitalize on Risk
  9. 9 IT Risk and IT Value
  10. 10 Risk IT Extends Val IT and COBIT
  11. 11 Where IT Risk Fits In
  12. 12 Cybersecurity TRIAD
  13. 13 Business-Driven Security
  14. 14 Cybersecurity Management
  15. 15 Organizational & Business Requirements
  16. 16 Cybersecurity Security Solutions
  17. 17 Cybersecurity Management
  18. 18 Cybersecurity Management
  19. 19 Cybersecurity Governance
  20. 20 Slide 20
  21. 21 Cybersecurity Governance
  22. 22 Security Blueprints
  23. 23 Policy Overview
  24. 24 Policy overview
  25. 25 Security Statement Example
  26. 26 Policy Infrastructure
  27. 27 Examples of Functional Policies
  28. 28 Internet usage policy sample
  29. 29 Policy Implementation
  30. 30 Standards and procedure
  31. 31 Security Baselines
  32. 32 Three Levels of security planning
  33. 33 Risk Management
  34. 34 Slide 34
Slide 1 / 34

Slide 1

Slide 1: Slide 1
Slide 2 / 34

Intended Learning Outcomes

Slide 2: Intended Learning Outcomes
Slide 3 / 34

Agenda

Slide 3: Agenda
Slide 4 / 34

Risks in Business

Slide 4: Risks in Business

Notes

  1. Every business decision carries risk; security exists to support business goals, not the other way round.

Slide 5 / 34

Why Care About Cyber Risk?

Slide 5: Why Care About Cyber Risk?
Slide 6 / 34

Why Care About Cyber Risk?

Slide 6: Why Care About Cyber Risk?
Slide 7 / 34

Why Care About Cyber Risk?

Slide 7: Why Care About Cyber Risk?
Slide 8 / 34

Manage and Capitalize on Risk

Slide 8: Manage and Capitalize on Risk
Slide 9 / 34

IT Risk and IT Value

Slide 9: IT Risk and IT Value

Notes

  1. IT risk is the flip side of IT value: managing risk protects the value IT creates.

Slide 10 / 34

Risk IT Extends Val IT and COBIT

Slide 10: Risk IT Extends Val IT and COBIT

Notes

  1. Risk IT extends Val IT and COBIT (ISACA frameworks) to cover IT-related business risk.

Exam angle

Past exam · Quiz 1, Term 222

the framework for compliance, risk and IT alignment

PredictionQ1

Which framework helps organizations with regulatory compliance, risk management and aligning IT strategy with business goals?

Slide 11 / 34

Where IT Risk Fits In

Slide 11: Where IT Risk Fits In
Slide 12 / 34

Cybersecurity TRIAD

Slide 12: Cybersecurity TRIAD

Notes

  1. CIA triad: Confidentiality (only authorized people see it), Integrity (not altered improperly), Availability (there when needed).

Exam angle

PredictionQ1

Making sure only those who are supposed to access the data can access it is:

Slide 13 / 34

Business-Driven Security

Slide 13: Business-Driven Security

Notes

  1. Business-driven security: start from business requirements and risk appetite, then choose controls.

Slide 14 / 34

Cybersecurity Management

Slide 14: Cybersecurity Management

Notes

  1. Management support is the most important factor for a successful security program.

Exam angle

PredictionQ1

The most important factor in ensuring security succeeds in an organization is:

Slide 15 / 34

Organizational & Business Requirements

Slide 15: Organizational & Business Requirements
Slide 16 / 34

Cybersecurity Security Solutions

Slide 16: Cybersecurity Security Solutions
Slide 17 / 34

Cybersecurity Management

Slide 17: Cybersecurity Management
Slide 18 / 34

Cybersecurity Management

Slide 18: Cybersecurity Management
Slide 19 / 34

Cybersecurity Governance

Slide 19: Cybersecurity Governance

Notes

  1. Governance: the board and executives set direction, accountability and oversight; management executes.

Exam angle

Past exam · Quiz 2

who should be involved in security risk management

PredictionQ1

Why should executives and IT/security teams communicate well?

Compare with the model answer

Executives own the business risk and the budget; IT/security understand the threats and controls. Without shared understanding, security spending won’t match business priorities and executives can’t make informed risk decisions.

Slide 20 / 34

Slide 20

Slide 20: Slide 20
Slide 21 / 34

Cybersecurity Governance

Slide 21: Cybersecurity Governance

Notes

  1. Data owner (a senior manager) decides the classification level of information; the custodian implements the protection.

  2. Trap Owner DECIDES classification; custodian (IT) IMPLEMENTS controls; auditors MEASURE effectiveness.

Exam angle

Past exam · Major exam

Related question: the person in charge of a data domain

PredictionQ1

Who has primary responsibility for determining the classification level of information?

PredictionQ2

Who should measure the effectiveness of information-security controls?

Slide 22 / 34

Security Blueprints

Slide 22: Security Blueprints
Slide 23 / 34

Policy Overview

Slide 23: Policy Overview

Notes

  1. Policies: high-level management statements of what must be protected and why (mandatory, technology-neutral).

Exam angle

PredictionQ1

Security policies are best described as:

Slide 24 / 34

Policy overview

Slide 24: Policy overview
Slide 25 / 34

Security Statement Example

Slide 25: Security Statement Example
Slide 26 / 34

Policy Infrastructure

Slide 26: Policy Infrastructure

Notes

  1. Hierarchy: policy (why) → standards (mandatory what) → procedures (step-by-step how) → baselines (minimum level) → guidelines (optional advice).

  2. Memory trick Policy = WHY, Standard = WHAT (mandatory), Procedure = HOW, Baseline = MINIMUM, Guideline = SHOULD.

Exam angle

PredictionQ1

Detailed step-by-step instructions for a task are:

PredictionQ2

Recommended but optional actions are:

Slide 27 / 34

Examples of Functional Policies

Slide 27: Examples of Functional Policies

Notes

  1. Data classification groups data by sensitivity (e.g. public, internal, confidential, secret) so each level gets suitable controls.

Slide 28 / 34

Internet usage policy sample

Slide 28: Internet usage policy sample
Slide 29 / 34

Policy Implementation

Slide 29: Policy Implementation
Slide 30 / 34

Standards and procedure

Slide 30: Standards and procedure
Slide 31 / 34

Security Baselines

Slide 31: Security Baselines
Slide 32 / 34

Three Levels of security planning

Slide 32: Three Levels of security planning

Notes

  1. Planning horizons: strategic (long term, 3–5 years), tactical (mid term, 6 months–1 year or more), operational (short term, day to day to ~6 months).

Exam angle

Past exam · Quiz 2

Renee’s one-to-six-month plan

PredictionQ1

A short-term security plan with a one- to six-month horizon is:

Slide 33 / 34

Risk Management

Slide 33: Risk Management

Notes

  1. Functionality = what a security mechanism does; assurance = the confidence that it does it correctly.

Exam angle

PredictionQ1

Security functionality defines what a mechanism does; assurance defines:

Slide 34 / 34

Slide 34

Slide 34: Slide 34