Cybersecurity Management Exam 2

IT Security Management

The formal process of developing and maintaining appropriate computer security for an organization's assets and the confidentiality, integrity, and availability of those assets.

Confidentiality, Integrity, and Availability (CIA)

Key security properties that IT security management works to protect.

IT Security Management Lifecycle

An ongoing, cyclic process with seven phases: Set Direction, Assess Risk, Select Controls, Plan the Work, Implement Controls, Monitor & Maintain, and Detect & React.

Set Direction

Define security objectives, strategies, and high-level policies based on the organization's context.

Assess Risk

Analyze threats and vulnerabilities to IT assets to understand and prioritize risk.

Select Controls

Choose administrative, operational, and technical controls that mitigate risk cost-effectively.

Plan the Work

Create detailed implementation plans, operational procedures, and system security documentation.

Implement Controls

Deploy physical, logical, and procedural controls and provide user security awareness training.

Monitor & Maintain

Continuously verify control performance, check compliance, and perform routine maintenance.

Detect & React

Detect security incidents, execute incident response plans, and use lessons learned to improve security direction.

Senior Management Buy-In

Executive support needed to establish accountability, security culture, and resources for security objectives.

Chief Information Security Officer (CISO)

The single accountable owner of an organization's security program who leads the Information Security Office.

CISO Reporting Line

The CISO may report to the Chief Information Officer (CIO) or the Chief Executive Officer (CEO); this involves operational tradeoffs.

Chief Information Officer (CIO)

An executive to whom the CISO may report.

Chief Executive Officer (CEO)

An executive to whom the CISO may report.

Risk

The probability that a threat source exploits a vulnerability and causes harm to an asset.

Risk Assessment

Identifying, analyzing, and evaluating risks to determine their severity and prioritize management decisions.

Risk Management

The ongoing enterprise cycle of framing, assessing, treating, monitoring, and reviewing risk.

Risk Mitigation

Safeguards and controls used to lower the likelihood and/or impact of a risk to an acceptable level.

Risk Appetite

The broad amount of risk an organization is willing to accept while pursuing its strategic objectives.

Risk Tolerance

The specific, measurable variation an organization permits around its target risk levels and risk appetite.

Risk Posture

The current overall security and risk condition of an organization's information systems and controls.

Baseline Risk Assessment

Applies standard baseline controls uniformly without customized risk scoring; best for small organizations with limited IT budgets and simple systems.

Informal Risk Assessment

Uses a quick, pragmatic expert review rather than formal structured tools; suited to small-to-medium organizations where IT is not critical to core operations.

Detailed Risk Assessment

A rigorous, structured analysis of assets, threats, vulnerabilities, likelihoods, and impacts; suited to large enterprises, government, critical infrastructure, and high-compliance sectors.

Combined Risk Assessment

Applies baseline security across all systems, then performs detailed analysis on high-risk or critical assets; balances protection and cost.

NIST SP 800-30

A risk assessment process with four steps: Prepare, Conduct, Communicate, and Maintain.

NIST SP 800-30 Workflow: Prepare

Get ready for the risk assessment by establishing its context and approach.

NIST SP 800-30 Workflow: Conduct

Perform the risk assessment.

NIST SP 800-30 Workflow: Communicate

Share risk assessment results with relevant stakeholders.

NIST SP 800-30 Workflow: Maintain

Keep the risk assessment current as conditions change.

Formal Risk Statement Template

A [Threat Source] could [Threat Event] by exploiting [Vulnerability], resulting in [Impact to the Asset].

Qualitative Risk Model

Uses rating scales for likelihood and consequence, then places risks in categories such as Low, Medium, High, or Extreme on a risk matrix.

Quantitative Risk Model

Assigns monetary values to risk and uses calculations such as Annualized Loss Expectancy.

Risk Matrix

A tool that combines likelihood and impact to classify risk, often as Low, Medium, High, or Extreme.

Single Loss Expectancy (SLE)

The monetary value lost from one risk event. Formula: SLE = Asset Value × Exposure Factor.

Asset Value

The monetary value assigned to an asset for calculating potential loss.

Exposure Factor

The proportion of an asset's value expected to be lost in a single risk event.

Annualized Rate of Occurrence (ARO)

The estimated frequency of a risk event per year; for example, once every two years equals 0.5.

Annualized Loss Expectancy (ALE)

The expected yearly cost of a risk. Formula: ALE = SLE × ARO.

Inherent Risk

The raw level of risk before any controls are applied.

Residual Risk

The risk remaining after controls are deployed.

Risk Treatment Strategies

Four options for treating risk: reduction/mitigation, avoidance, transference, or acceptance.

Risk Reduction/Mitigation

Treat risk by applying safeguards or controls to lower its likelihood or impact.

Risk Avoidance

Treat risk by avoiding the activity or situation that creates the risk.

Risk Transference

Treat risk by transferring some risk or its financial consequences to another party.

Risk Acceptance

Treat risk by deciding to retain the risk.

Security Control

An action, device, procedure, or technique that reduces risk by preventing violations, minimizing harm, or detecting breaches so corrective action can be taken.

Management Controls

Controls that guide overall security implementation.

Operational Controls

Daily procedures and practices carried out primarily by people rather than automated systems.

Technical Controls

Hardware and software capabilities built directly into information systems.

Supportive Technical Controls

Pervasive, underlying IT capabilities shared across multiple controls.

Preventative Technical Controls

Controls that inhibit security-policy violations or exploitation of vulnerabilities before a breach occurs.

Detection & Recovery Technical Controls

Controls that detect active breaches or policy failures and help restore compromised systems and data.

Control Classification: Class vs. Function

Class describes who or what executes a control; function describes how technical controls operate.

NIST SP 800-53 Rev. 5

A catalog organizing security and privacy controls into 20 families across Management, Operational, and Technical classes.

ISO/IEC 27002:2022

A standard that structures 93 controls into four theme areas.

Seven-Step Control Implementation Workflow

Prioritize actions; evaluate control options; conduct cost-benefit analysis; select controls; assign responsibility; develop a safeguard plan; implement controls and accept residual risk.

Prioritize Actions

Rank identified risks by severity scores.

Evaluate Control Options

Assess possible controls for feasibility and effectiveness.

Control Cost-Benefit Analysis

Calculate Net Value = Original ALE − (Annual Control Cost + Residual ALE).

Net Value of a Control

Original ALE minus the sum of annual control cost and residual ALE.

Control Selection Decision Rules

If a control costs more than the risk it removes, choose an alternative; if it does not reduce risk enough, add complementary controls.

Control Owner

The person designated as responsible for a control.

Safeguard Plan

Documents resources, timelines, start and end dates, and milestone metrics for control implementation.

Implement Controls & Accept Residual Risk

Deploy controls, re-score risk, and obtain formal sign-off for the remaining residual risk.

Policy

A document defining high-level intent, direction, and expectations; strategic/executive level.

Standard

A document establishing specific, measurable baseline requirements to enforce policy; tactical level.

Guideline

Recommended best practices and operational advice; advisory level.

Procedure

Step-by-step instructions for carrying out daily operational tasks; operational level.

Policy Hierarchy (highest-level to task-level)

Policy → Standards → Guidelines → Procedures.

Self-Assessment

A compliance review in which an organization assesses its own controls.

Internal Audit

A compliance assessment conducted internally to evaluate control effectiveness.

External Audit

A compliance assessment conducted by an outside auditor.

Regulatory Assessment

A review that evaluates compliance with applicable regulatory requirements.

Continuous Monitoring

Ongoing checking of controls and security conditions over time.

System Security Plan (SSP)

A formal document describing how a specific system meets security requirements; it serves as the master blueprint for authorization decisions.

Physical Security

Safeguards tangible assets, facilities, and supporting environmental infrastructure against physical threats that could compromise logical security.

Logical Security

Protects computer-based data from software and network threats.

Physical/Infrastructure Security

Protects processing equipment, communications links, and storage media from physical access or environmental harm.

Premises/Facilities Security

Protects the overall site, buildings, and personnel through perimeter control and surveillance.

Environmental Threats

Threats such as natural disasters, temperature or humidity fluctuations, fire, water, contaminants, and pests.

Technical Physical Threats

Physical infrastructure threats such as power dips, overvoltage, and electromagnetic interference.

Human-Caused Physical Threats

Threats such as unauthorized access, theft, vandalism, and misuse; these are described as the least predictable.

Resilience Roadmap

Plan → Build Redundancy → Diversify → Test.

Redundancy

The fundamental foundation of disaster recovery; provides backup capacity or components.

Recovery Time Objective (RTO)

The recovery-time goal associated with restoring operations after a disruption.

Hot Site

A fully operational recovery facility equipped with hardware, software, network links, and live data mirroring; recovery objective is minutes to hours.

Warm Site

An environmentally conditioned workspace with power and network and some hardware; backups must be restored; recovery objective is hours to days.

Cold Site

A powered, HVAC-conditioned empty facility without computer equipment installed in advance; recovery objective is days to weeks.

Hot vs. Warm vs. Cold Site

Hot: fully equipped with live data mirroring, minutes to hours. Warm: partially equipped and needs backups restored, hours to days. Cold: empty of computer equipment, days to weeks.