Risk Management & Incident Response
CYBR 432
Home Work
Ebtehaj Alharbi
Answer the following Questions Using lectures (1-2-3-4)
Q1: What is risk management and why is it important?
It is the process of identifying and controlling the risks to an organization's information
assets.
It identifies vulnerabilities in an organization's information systems and takes carefully
reasoned steps to ensure the confidentiality, integrity, and availability of all the
components of the organization's information system, and reduce risk and improves
efficiency and productivity.
Q2: Talk about one threats you may exposed and give an example
Human error:
like overconfidence bias, can blindside even the best plans. Imagine rushing a software
project due to optimism, leading to delays, budget busts, and damaged reputations. To
avoid this, challenge assumptions, gather diverse perspectives, and use proper risk
assessment tools.
Q3: There is five approaches for controlling the risks, what is it?
With detail
1. Defense: This is the most proactive approach, where you directly address the
vulnerability by implementing controls and safeguards. This could involve
installing security software, patching systems, implementing access controls, and
training employees on security best practices. The goal is to prevent an attacker
from exploiting the vulnerability in the first place.
2. Transference: This involves shifting the risk to another party. This could be done
through insurance, where you pay a premium in exchange for the insurance
company covering the costs of an attack. Alternatively, you could outsource your
security operations to a managed security service provider, who would then be
responsible for managing your security infrastructure and addressing
vulnerabilities.
Risk Management & Incident Response
CYBR 432
Home Work
3. Mitigation: This approach focuses on minimizing the impact of an attack should
one occur. This could involve implementing data backups and disaster recovery
plans, so that you can quickly restore your systems in the event of an attack. You
can also implement measures to limit the damage an attacker can do, such as data
encryption and segmentation.
4. Acceptance: This is the least proactive approach, and it essentially means
accepting the risk and living with the consequences. This is only valid after a
thorough risk assessment and with full understanding of the potential impact of an
attack. This might be appropriate for low-risk vulnerabilities or where the cost of
implementing controls outweighs the potential damage.
5. Termination: This is the most drastic approach and involves removing the
vulnerable asset from your environment altogether. This could be done by
disconnecting a system from the network, discontinuing a service, or shutting
down a business process. This is usually only justified for very high-risk
vulnerabilities where other options are not feasible.
Q4: What do you know about Business Impact Analysis (BIA)?
BIA helps you understand the business cost of a cyberattack, prioritize recovery efforts,
and build resilience against future threats.
1. Disaster Prep for Business: Like prepping for a storm, BIA examines potential
disruptions (power outages, cyberattacks, etc.) and their impact on critical
functions.
2. Prioritizing the Essentials: BIA identifies and ranks what needs protection most.
3. Damage Control Roadmap: It outlines recovery steps: minimizing damage,
responding, and bouncing back to normal.
4. Picks Up Where Risk Leaves Off: Unlike risk management which focuses on
preventing attacks, BIA assumes the worst-case scenario – the attack happened.
5. Key to Business Continuity: BIA informs planning for business continuity -
ensuring your organization stays afloat during and after disruptions.
Risk Management & Incident Response
CYBR 432
Home Work
Q5: When an organization wants its operations to resume at a location over
which it has exclusive control, What options does they have?
When an organization needs its operations to resume at a location under its control after a
disruption, they have several options, depending on the severity and nature of the
situation:
1. Immediate Recovery:
o Hot Site: A fully pre-configured facility ready for immediate operation,
similar to a fully stocked office.
o Warm Site: Similar to a hot site but with less pre-configured equipment,
requiring some setup time.
o Cold Site: A basic space with essential infrastructure but no pre-installed
equipment, needing significant setup and configuration.
2. Alternative Locations:
o Secondary Facility: Temporarily shifting operations to another fully
operational site, such as a branch office or headquarters.
o Remote Work: Implementing a work-from-home plan for essential
employees to continue operations remotely.
3. Hybrid Approach:
o Combining elements of the above options, such as using a hot site for
critical functions and remote work for non-critical tasks. This approach
involves splitting the team between a temporary office and working from
home based on their roles.
