Chapter 4 example #10001

B. Risk = Threat X Vulnerability The risk equation is Risk = Threat X Vulnerability. A threat is the frequency of any event. In most cases, the events in the threat equation are negative or adverse events. Vulnerability is the likelihood that a specific threat will successfully be carried out. Multiplying the probability of a threat and the likelihood of a vulnerability yields the risk of that particular event

C. Risk survey results The risk register can contain many different types of information but should contain at a minimum: a description of the risk, the expected impact if the associated event occurs, the probability of the event occurring, steps to mitigate the risk, steps to take should the event occur, and the rank of the risk. Risk survey results are not typically included in a risk register.

A. Recovery time objective (RTO) The RTO expresses the maximum allowable time to recover a function. Time may be a critical factor and specifying the requirements for recovery time helps determine the best recovery options.

D. Facility repair Direct costs are immediate expenditures that reduce profit, such as the cost to repair a facility. Indirect costs, such as damaged reputation, lost market share, and lost customers, affect revenue but are harder to calculate because there is no record of an expenditure.

C. Business continuity plan (BCP) BCPs specify how an organization can recover from an interruption, as opposed to a disaster that would be covered by the DRP. In general, an interruption is a minor event that may disrupt one or more business processes for a short period. In contrast, a disaster is an event that affects multiple business processes for an extended period. Disasters often also cause substantial resource damage that you must address before you can resolve the business process interruption.

D. Ensure that everyone is safe. The first critical step in a disaster recovery plan is to ensure that everyone is safe. The second step is responding to the disaster before pursuing recovery, and the final step is following the DRP, which includes communicating with all affected parties.

B. Warm site A warm site balances cost and switchover time. It is less expensive than a hot site but can activate more quickly than a cold site.

C. Parallel test The parallel test evaluates the effectiveness of the disaster recovery plan (DRP) by enabling full processing capability at an alternate data center without interrupting activity at the primary data center.

C. Simulation test A simulation test is more realistic than a structured walk-through. In a simulation test, the DRP team uses role playing and follows through with as many of the effects of a simulated disaster as possible without affecting live operations.

A. Moving to a warm site The use of alternate processing facilities, such as warm sites, is a reactive control. Some parts of a disaster recovery plan (DRP) are preventive and intended to avoid the negative effects of a disaster in the first place. Preventive components of a DRP may include disk mirroring, surge suppression, and antivirus software.

A. Risk Management Guide for Information Technology Systems (NIST SP800-30) NIST SP800-30, "Risk Management Guide for Information Technology Systems," is a widely used guide for IT security assessments. It contains specific guidance for U.S. government agencies and would be the most appropriate methodology for use in a federal government setting

C. HIPAA Health Insurance Portability and Accountability Act (HIPAA) governs the way doctors, hospitals, and other health care providers handle personal medical information. HIPAA requires that all medical records, billing, and patient information be handled in ways that maintain the patient's privacy.

B. Payment Card Industry Data Security Standard (PCI DSS) PCI DSS applies to all merchants and service providers who handle credit card information.

B. 13

C. Access control lists Once you have authenticated a user, access controls help ensure that only authorized users can access the protected resources. Authorization controls include access control lists, intrusion prevention systems, and network traffic filters.

D. Data ownership

B. Network firewall A network firewall is not an endpoint control because it is deployed on a network connection. Full device encryption, remote wiping, and application control are all examples of endpoint device security controls.

C. Safety

A. Family Education Rights and Privacy Act (FERPA)

D. No technology infrastructure

A. True

B. False Risk methodology is a description of how you will manage risk. The risk register is a list of identified risks that results from the risk-identification process.

A. True

A. True

A. True

B. False Safety and well-being of people is the first priority in a well-balanced BCP.

A. True

B. False The steps involved in creating a comprehensive DRP should be completed in this order: define potential threats, document likely impact scenarios, and document the business and technical requirements to initiate the implementation phase.

B. False A mobile site is very flexible, has a fairly short switchover time, and has widely varying costs based on size and capacity. A cold site is the least expensive option but at the cost of the longest switchover time, since all hardware, software, and data must be loaded at the new site.

B. False : Most enterprises remain unprepared or underprepared for disaster. Despite recurrent reminders, many companies do not have a disaster recovery plan (DRP) at all.

A. True

B. False A gap analysis is a comparison of the security controls you have in place and the controls you need in order to address all identified threats. A security policy defines a risk-mitigating definition or solution for your organization

A. True

A. True

A. True

B. False Authorization controls include access control lists, physical access control, and network traffic filters. A biometric device is an authentication control.

A. True

A. True

A. True

B. False Mobile device management (MDM) includes a software application that allows organizations to monitor, control, data wipe, or data delete business data from a personally owned device.