CYS403 · Chapter 6 · Annotated SlidesPerforming a Risk Assessment
Original
Overview

Performing a Risk Assessment

Preparing for a risk assessment, the RA plan, identifying assets and activities, evaluating threats, vulnerabilities and countermeasures, writing mitigating recommendations, presenting the results and best practices.

How to read this page

Every original slide is shown unchanged. Yellow marks on a slide point to a numbered note: hover or tap a mark to jump to its note, and hover a note to see its marks. Questions tagged Past exam appeared on a real paper; Prediction questions are likely angles, not confirmed. Pick an answer to each question: a wrong pick tells you why it is wrong, so you can try again.

All 18 slides
  1. 1 Slide 1
  2. 2 Prepare for RA
  3. 3 Prepare for RA
  4. 4 Prepare for RA
  5. 5 Prepare for RA
  6. 6 Prepare for RA
  7. 7 RA plan (steps to do)
  8. 8 Identify assets and activities to address.
  9. 9 Identify assets and activities to address.
  10. 10 Identify assets and activities to address.
  11. 11 Identifying and Evaluating Relevant Threats
  12. 12 Identifying and Evaluating Relevant Vulnerabilities
  13. 13 Identifying and Evaluating Countermeasures
  14. 14 Slide 14
  15. 15 Develop Mitigating Recommendations
  16. 16 Present Risk Assessment Results
  17. 17 Best Practices for Performing Risk Assessments
  18. 18 Slide 18
Slide 1 / 18

Slide 1

Slide 1: Slide 1
Slide 2 / 18

Prepare for RA

Slide 2: Prepare for RA

Notes

  1. Prepare: define scope and boundaries, get management support, identify stakeholders and data sources.

Slide 3 / 18

Prepare for RA

Slide 3: Prepare for RA
Slide 4 / 18

Prepare for RA

Slide 4: Prepare for RA
Slide 5 / 18

Prepare for RA

Slide 5: Prepare for RA
Slide 6 / 18

Prepare for RA

Slide 6: Prepare for RA
Slide 7 / 18

RA plan (steps to do)

Slide 7: RA plan (steps to do)

Notes

  1. RA plan: the step-by-step list of what will be assessed, by whom, how and when.

Slide 8 / 18

Identify assets and activities to address.

Slide 8: Identify assets and activities to address.

Notes

  1. Identify the assets and activities in scope (systems, data, processes) and who owns them.

Slide 9 / 18

Identify assets and activities to address.

Slide 9: Identify assets and activities to address.
Slide 10 / 18

Identify assets and activities to address.

Slide 10: Identify assets and activities to address.
Slide 11 / 18

Identifying and Evaluating Relevant Threats

Slide 11: Identifying and Evaluating Relevant Threats

Notes

  1. Evaluate relevant threats: which threat sources could target each asset, and how likely they are.

Slide 12 / 18

Identifying and Evaluating Relevant Vulnerabilities

Slide 12: Identifying and Evaluating Relevant Vulnerabilities

Notes

  1. Evaluate vulnerabilities: scans, audits, interviews, documentation reviews.

Slide 13 / 18

Identifying and Evaluating Countermeasures

Slide 13: Identifying and Evaluating Countermeasures
Slide 14 / 18

Slide 14

Slide 14: Slide 14
Slide 15 / 18

Develop Mitigating Recommendations

Slide 15: Develop Mitigating Recommendations

Notes

  1. Recommend mitigations: controls ranked by the risk they reduce and their cost.

Slide 16 / 18

Present Risk Assessment Results

Slide 16: Present Risk Assessment Results

Notes

  1. Present the results to management, then track the agreed actions (implementation, monitoring, reassessment).

Exam angle

Past exam · Major exam

two steps after finishing the risk assessment

PredictionQ1

Name two steps to do after finishing a risk assessment.

Compare with the model answer

Present the results and recommendations to management for decisions; implement the approved controls (a mitigation plan with owners and deadlines); then monitor and reassess the risks periodically.

Slide 17 / 18

Best Practices for Performing Risk Assessments

Slide 17: Best Practices for Performing Risk Assessments

Notes

  1. Best practices: involve stakeholders, use a consistent method, document everything, repeat regularly.

Slide 18 / 18

Slide 18

Slide 18: Slide 18