Cybersecurity Management Final Complete Exam Review With Full Solutions

CYBERSECURITY MANAGEMENT FINAL
COMPLETE EXAM REVIEW WITH FULL
SOLUTIONS

●● Cybersecurity Risk Management
Answer: is a set of policies, processes, and controls to protect the
organization's information assets from security incidents.


●● Who leads Cybersecurity Risk Management?
Answer: CIO
CISO
other IS managers


●● Risk Assessment
Answer: 1. Identify and analyze potential risk that may negatively
impact an organization or its stakeholders


2. make judgment on the acceptance or tolerability of the risks.


●● Framework for Risk Assessment
Answer: Risk identification: vulnerability

,Risk estimation: level or severity


Risk evaluation: business impact


●● Risk Assessment Formula
Answer: Cybersecurity risk=f(vulnerability, severity, impact)


●● vulnerability
Answer: is the likelihood of a cybersecurity incident


●● Severity
Answer: the level of risk associated with the incident


●● Impact
Answer: the business loss caused by the incident


●● National Cyber Incident Scoring System (NCISS)
Answer: is designed to provide a repeatable and consistent mechanism
for estimating the risk of an incident.


●● Risk Treatment Strategies
Answer: Risk Reduction (Defense and Mitigation)

, Risk transference
Risk acceptance
Risk termination


●● Defense (avoidance)
Answer: attempts to prevent the exploitation of the vulnerability.


●● Mitigation
Answer: is the treatment approach that focuses on planning and
preparation to reduce the impact or potential consequences of an
incident or disaster.


●● Common Defense Methods?
Answer: Application of policy (e.g., ISP)


Application of SETA programs


Implementation of technology


●● 4 Mitigation Plans
Answer: Business continuity (BC) plan


Disaster recovery (DR) plan