Usec 3.1

Risk Management

The process of identifying, assessing, and reducing risks facing an organization

Risk Identification

The enumeration and documentation of risks to an organization’s information assets

Risk Control

The application of controls that reduce the risks to an organization’s assets to an acceptable level

Risk Appetite

Defines the quantity and nature of risk that organizations are willing to accept as trade-offs between perfect security and unlimited accessibility

Residual Risk

Risk that has not been completely removed, shifted, or planned for

Threat Assessment

A process that identifies and quantifies the risks facing each asset

Information Owners

Responsible for classifying information assets

Vulnerability

Specific avenue a threat agent can exploit to attack an information asset

Threats-Vulnerabilities-Assets (TVA)

Combines the prioritized list of threats, vulnerabilities, and assets

Loss Frequency

Assessment of the likelihood of an attack combined with the expected probability of success

Defense

Risk control strategy that attempts to prevent exploitation of the vulnerability

Transfer

Risk control strategy that attempts to shift risk to other assets, processes, or organizations

Mitigation

Risk control strategy that attempts to reduce the impact of an attack rather than reduce the success of the attack itself

Acceptance

Risk control strategy of doing nothing to protect a vulnerability and accepting the outcome of its exploitation

Termination

Risk control strategy of avoiding business activities that introduce uncontrollable risks

Cost-Benefit Analysis (CBA)

Determines if an alternative being evaluated is worth the cost incurred to control a vulnerability

Quantitative Assessment

Risk assessment method that uses actual values or estimates

Qualitative Assessment

Risk assessment method that uses characteristics and nonnumerical measures

Benchmarking

Process of seeking out and studying practices in other organizations that an organization desires to duplicate

Metrics-Based Measures

Measures based on numerical standards

Process-Based Measures

Measures that are more strategic and less focused on numbers

Baselining

Performance value or metric used to compare changes in the object being measured

Information Security Baselining

Comparison of past security activities and events against an organization's future performance

Operational Feasibility

Assesses user and management acceptance and support, and the overall requirements of the organization’s stakeholders

Technical Feasibility

Assesses if organization has or can acquire the technology necessary to implement and support proposed control