CRISC DOMAIN 2.pdf

CRISC EXAM PREP COURSE: SESSION 2

Trusted by over 1 million members

Try Scribd FREE for 30 days to access over 125 million titles without ads or interruptions! Start Free Trial Cancel Anytime.



















Job Jo b Practic Practice e



















DOMAIN 2 IT RISK ASSESSMENT



















Do m ai n 2 An A n al aly y ze and an d ev eval alu u at ate e IT ri r i s k t o d et eter erm mine the likeliho likelihood od and and impa i mpact ct on busin b usine ess obje obj ecti ctive ves s to ena nable ble risk-ba ri sk-base sed d de decis cisio ion n making. 

The focus of Domain 2 is the assessment of risk scenarios to determine risk



















Learn Lea rnin ing g Obj Obje ect ctiv ive es 

The objective of this domain is to ensure that the CRISC candidate has the knowledge necessary to: – Identify and apply app ly risk assessment asse ssment techniques techniq ues – Analyze risk scenarios s cenarios – Identify current current state of controls – Assess gaps between current cu rrent and desired des ired



















On t h e CRI CRISC SC Exam 



Domain 2 represents 28% of the questions on the CRISC exam (approximately 42 questions). Domain 2 incorporates six tasks related to IT risk assessment.





















Do m ai n Tas ks 



Analyze risk scenarios based on organizational criteria (e.g., 2.1 Analyze organizational structure, policies, standards, technology, technology, architecture, controls) to determine the likelihood and impact of an identified risk. 2.2 Identify the current state of existing controls and evaluate their



















Task 2.1

An A n al aly y ze ri r i s k s c en enar arii o s b as ased ed o n



















Task to Kn Know owledg ledge e State Statement ments s How does Task Task 2.1 2.1 relate relate to each each of the fol lowing low ing know ledge statements? Knowl Kno wl edge Sta Statement tement

Connectio n

13. 13. Risk Risk anal analy ysis sis

The selection of risk analysis methodology is



















Com omparin paring g Pro Processe cesses s Risk Identification • Dete Determ rmin ines es and and

Risk As A s s es ess s m en entt • Ev Evalu aluat ates es risk risks s and and thei theirr



















Ris isk k Impact Fa Fact ctor ors s Organizational Structure and Culture

• What is the organizational organizational maturity maturity level regarding regarding risk management and incident response? • Is there enterprisewide enterprisewide support for for and participation participation in risk management? Does the organizational organizational culture encourage encourage communication communication





















Ris isk k Impact Fa Fact ctor ors s

(cont’d)



















Ris isk k Impact Fa Fact ctor ors s

(cont’d)



















The Cont Control rol Envi nviron ronme ment nt



















Con ontr trol ol Categor tegories ies



















Con ontr trol ol Categor tegories ies

(cont’d)







































































































































































































































Task to Kn Know owledg ledge e State Statement ments s How does Task Task 2.3 2.3 relate relate to each each of the fol lowing low ing know ledge statements? Knowl Kno wl edge Sta Statement tement

Connectio n

32. 32. Key Key ris risk k ind indic icat ator ors s (KRIs)

Key Risk Indicators allow management to monitor and measure situations that may give rise to risk in order to make corrective actions before an adverse event materializes.

37. 37. Key Key perf perfor orma manc nce e indicator (KPIs)

A Key Performance Indicator permits management to validate that controls are performing as expected (desired) and show trends in i n control behavior.

38. Contr Control ol type types, s, stan standar dards, ds, Control types, standards and frameworks are adopted by organizations to bring repeatability and



















Focus On: Capability 



When assessing risk, it is important to measure the capability and maturity of the risk management processes of the organization. An organization organiza tion with a capable capa ble and mature risk management process is much more likely to do the following: – Prevent incidents – Detect incidents sooner



















Focus On: Capability 

(cont’d)

Examples of key elements used to measure IT risk management capability include the following: – Support of senior management – Regular communication between between stakeholders – Existence of policy, policy, procedures and standards – Logging and monitoring of system activity – Scheduled risk assessments and review review – Testing of business continuity plans and disaster recovery recovery plans



















Data An Ana aly lysi sis s Chall halle eng nge es 



The information yielded by data sources serves as the basis of risk and control analyses. The presence of too much data can ca n present risk of its own, as follows: – Too much data may hide or obscure important but less visible events. – Incorrect analysis of data may lead to erroneous conclusions. – Completeness and trustworthiness of data may be



















Data An Ana aly lysi sis s Appr Ap proache oaches s 

Some approaches to conducting the analysis of data are shown below.

Appr Ap pr oac h

Descr Des cr i pt i on

Root cause analysis analysis

Predictive or diagnostic tools used to explore root causes, underlying conditions and core factors leading to an event, used to identify potential risk. Often expressed in fishbone or Ishikawa diagram format.

Fault Fault tree analysis

Provides a systematic description of the combination of possible occurrences in a system resulting from a top-level event, including hardware failures and human error. Focus is on locating the root causes and their preconditions.

Sensitivity analysis

Quantitative technique designed to determine which risk factors





















Gap Analysi A nalysis s 



Gap analysis is based on a comparison of the current state or conditions with respect to risk and the desired state or conditions. The difference between these two is the “gap.”



















Gap Analysi A nalysis s

(cont’d)

Indicator

Description

Key perform ance indicator (KPI)

Measure of how well a process enables enables a goal to be reached. An indicator of capabilities, practices practices and skills; can be used to indicate whether current risk levels match desired risk levels



















Ris isk k Ra Rank nkin ing g 

The total level of risk associated with a threat is derived from combining the following information sets: – Identification of the threat – Characteristics and capabilities of the threat threat source Likelihood of attack



















Disc iscuss ussion ion Que Questi stion on 

The PRIMARY benefit PRIMARY benefit of using a maturity model to assess the enterprise’s data management process is that it:




















An enterprise is hiring a consultant to help determine the maturity level of the risk management program. The MOST





















Task 2.4



















Task to Kn Know owledg ledge e State Statement ments s



















Risk Ownership



















Risk Accoun Ac counta tabili bility ty



















Disc iscuss ussion ion Que Questi stion on







































































































































































































































The IAAA IAA A Mo Mo del 

Access control con trol is usually addressed ad dressed through the following, referred to by the acronym IAAA:

Identification

The unique identification of each person or process that uses a system allows tracking and logging of the activity by the user and the possibility to investigate a problem if it were to arise.

Aut Au t hen ti c ati on

Authentication is the process of validating an identity. identity. After After a person or process has claimed or stated his/her hi s/her identity, identity, the process of authentication verifies that the person is who they say they are.

Aut Au t ho r i zati on

Refers to the privileges or permissions the person will have,



















Ident dentit ity y Manageme nagement nt 



Identity management is the process of managing the identities of the entities (users, processes, etc.) that require access to information or information systems. It is currently one of the most difficult challenges for system administrators.



















Ide denti ntity ty Authe Aut henti ntica catio tion n 

Identity authentication is usually done using three methods, as follows:

Auth Au th ent ic ati on

Desc ri pt io n

Challen Chal len ge

Knowledge

Requires users to know a password, code phrase or other secret value to validate their identity

The risk in this method met hod of authentication is that learning the password of another person allows an individual other than the password owner to log in.

Ownership (possession)

Requires the use of a smart card, token, ID badge or other similar item; a person validates their identity by possessing the item

The cost of installing this type of system, issuing the cards and operating and maintaining the system may be prohibitive. Also, in the event the authorized user user loses his or her card, it may be used by an imposter if the card has not been reported as




















Risk assessments should be repeated at regular intervals because: A. omissions in earlier assessments as sessments can ca n be addressed. B. period periodic ic assess assessme ments nts allow allow variou various s methodologies. C. busine business ss threat threats s are const constant antly ly chang changing ing..




















Once a risk assessment has been completed, the documented test results should be: A. destroyed. destroyed . B. retained. C. sum summari arized zed. D. published.





















Learn Lea rnin ing g Obj Obje ect ctiv ive e1

Ide denti ntify fy and app apply ly ris risk k ass sse ess ssme ment nt te tech chni niqu que es. A wide variety of risk assessment techniques



















Learn Lea rnin ing g Obj Obje ect ctiv ive e2 An A n al aly y ze ri r i s k s c en enar arii o s . 

The impact of a risk event is difficult to calculate with any degree of accuracy



















Learn Lea rnin ing g Obj Obje ect ctiv ive e3 Ide denti ntify fy cur c urre rent nt sta s tate te of cont c ontrol rols. s. 

Current state refers to the condition of controls at a point in time.



















Learn Lea rnin ing g Obj Obje ect ctiv ive e4 A s s es As ess s g ap aps s b et etw w een c u r r en entt an and d desire desir ed state s tates s of o f the t he IT IT ri risk sk environment.



















Learn Lea rnin ing g Obj Obje ect ctiv ive e5 Com ommu muni nicate cate IT ri risk sk ass sse ess ssment ment results resul ts to t o relevant relevant sta st akehol keholders. ders. 

The responsibility of risk ownership must be





















CRISC DOMAIN 2.pdf

Recommend Documents