CYS403 · Chapter 4 · Annotated SlidesRisk Management Lifecycle
Original
Overview

Risk Management Lifecycle

Accountability for risk, the risk-management cycle, risk identification, building an information-asset inventory, classifying, valuing and ranking assets, threat identification, vulnerability assessment and the TVA worksheet.

How to read this page

Every original slide is shown unchanged. Yellow marks on a slide point to a numbered note: hover or tap a mark to jump to its note, and hover a note to see its marks. Questions tagged Past exam appeared on a real paper; Prediction questions are likely angles, not confirmed. Pick an answer to each question: a wrong pick tells you why it is wrong, so you can try again.

All 31 slides
  1. 1 Slide 1
  2. 2 ▪ CLO 2: Synthesize the principles of cyber security risk management
  3. 3 Overview on the Risk management lifecycle
  4. 4 Risk Management
  5. 5 Accountability for Risk Management
  6. 6 Risk management cycle
  7. 7 Risk management action points
  8. 8 Steps in Risk Management
  9. 9 Risk Identification
  10. 10 Asset Identification, valuation, ranking
  11. 11 Information Asset Inventory creation (contd.)
  12. 12 Information Asset Inventory creation (contd.)
  13. 13 Example: Network Asset tracker
  14. 14 Information Asset Inventory creation (contd.)
  15. 15 Information Asset Inventory creation (contd.)
  16. 16 Information Asset Inventory creation (contd.)
  17. 17 Information Asset Inventory creation (contd.)
  18. 18 Classifying and Categorizing Assets
  19. 19 Slide 19
  20. 20 Asset Valuation
  21. 21 Assessing Values for Information Assets - Questions
  22. 22 Example on asset valuation
  23. 23 Next: Asset ranking
  24. 24 Next step: Threat Identification
  25. 25 Vulnerability Assessment
  26. 26 Examples
  27. 27 Summary of Threat Vulnerability Analysis
  28. 28 T VA Worksheet
  29. 29 T VA worksheet
  30. 30 What is next?
  31. 31 Slide 31
Slide 1 / 31

Slide 1

Slide 1: Slide 1
Slide 2 / 31

▪ CLO 2: Synthesize the principles of cyber security risk management

Slide 2: ▪ CLO 2: Synthesize the principles of cyber security risk management
Slide 3 / 31

Overview on the Risk management lifecycle

Slide 3: Overview on the Risk management lifecycle
Slide 4 / 31

Risk Management

Slide 4: Risk Management
Slide 5 / 31

Accountability for Risk Management

Slide 5: Accountability for Risk Management

Notes

  1. Everyone has a role: management sets direction, IT/security implement, users follow policy, auditors check.

Slide 6 / 31

Risk management cycle

Slide 6: Risk management cycle

Notes

  1. Cycle: identify → assess → treat → monitor and review → repeat. Risk identification happens continuously, not once.

Exam angle

Past exam · Quiz 2

when risk identification is performed

PredictionQ1

Risk identification should be performed:

Slide 7 / 31

Risk management action points

Slide 7: Risk management action points
Slide 8 / 31

Steps in Risk Management

Slide 8: Steps in Risk Management
Slide 9 / 31

Risk Identification

Slide 9: Risk Identification

Notes

  1. Risk identification = identify, classify and prioritize assets, then the threats and vulnerabilities against them.

Slide 10 / 31

Asset Identification, valuation, ranking

Slide 10: Asset Identification, valuation, ranking

Exam angle

Past exam · Major exam

asset identification documentation; two assets with two attributes

PredictionQ1

List two information assets with two attributes each.

Compare with the model answer

Server: name/IP address, location (or MAC, serial number). Customer database: data owner, classification level (or format, size). Any asset with identifying attributes such as name, ID, location, owner, version, classification.

Slide 11 / 31

Information Asset Inventory creation (contd.)

Slide 11: Information Asset Inventory creation (contd.)
Slide 12 / 31

Information Asset Inventory creation (contd.)

Slide 12: Information Asset Inventory creation (contd.)
Slide 13 / 31

Example: Network Asset tracker

Slide 13: Example: Network Asset tracker
Slide 14 / 31

Information Asset Inventory creation (contd.)

Slide 14: Information Asset Inventory creation (contd.)
Slide 15 / 31

Information Asset Inventory creation (contd.)

Slide 15: Information Asset Inventory creation (contd.)
Slide 16 / 31

Information Asset Inventory creation (contd.)

Slide 16: Information Asset Inventory creation (contd.)
Slide 17 / 31

Information Asset Inventory creation (contd.)

Slide 17: Information Asset Inventory creation (contd.)
Slide 18 / 31

Classifying and Categorizing Assets

Slide 18: Classifying and Categorizing Assets

Notes

  1. Classify assets (confidential, internal, public…) and categorize them so their importance can be compared.

Slide 19 / 31

Slide 19

Slide 19: Slide 19
Slide 20 / 31

Asset Valuation

Slide 20: Asset Valuation

Notes

  1. Valuation questions: how critical to the mission, how much revenue or profit, cost to replace or protect, embarrassment if lost.

Slide 21 / 31

Assessing Values for Information Assets - Questions

Slide 21: Assessing Values for Information Assets - Questions
Slide 22 / 31

Example on asset valuation

Slide 22: Example on asset valuation
Slide 23 / 31

Next: Asset ranking

Slide 23: Next: Asset ranking

Notes

  1. Rank assets by weighted factor analysis to decide what to protect first.

Slide 24 / 31

Next step: Threat Identification

Slide 24: Next step: Threat Identification
Slide 25 / 31

Vulnerability Assessment

Slide 25: Vulnerability Assessment

Notes

  1. Vulnerability assessment: for each threat to each asset, list how it could be exploited.

Slide 26 / 31

Examples

Slide 26: Examples
Slide 27 / 31

Summary of Threat Vulnerability Analysis

Slide 27: Summary of Threat Vulnerability Analysis
Slide 28 / 31

T VA Worksheet

Slide 28: T VA Worksheet

Notes

  1. TVA worksheet: assets (ranked) on one axis, threats (ranked) on the other; each cell lists the vulnerabilities; work from the top-left (highest priority).

Exam angle

PredictionQ1

In a TVA worksheet, the highest-priority cells are:

Slide 29 / 31

T VA worksheet

Slide 29: T VA worksheet
Slide 30 / 31

What is next?

Slide 30: What is next?
Slide 31 / 31

Slide 31

Slide 31: Slide 31