CYS403 · Annotated SlidesChapter 1 — Security Risk Management, Governance and Control
Chapter 1 · Annotated slides

Security Risk Management, Governance and Control

Why cyber risk matters to the business, IT risk vs. IT value (Risk IT, Val IT, COBIT), the CIA triad, business-driven security, cybersecurity management and governance, security blueprints, the policy hierarchy (policies, standards, procedures, baselines, guidelines) and planning horizons.

Slide text Study notes Highlight: key words Tips, tricks & traps Seen again elsewhere How it can come up
Slide 1: Slide 1
Exam weight Low

    Intended Learning Outcomes

    • CLO 1: Evaluate the issues and concerns indicative to protecting information, systems and users.
    Intended Learning Outcomes
    2
    Exam weight Low

      Agenda

      • Introduction to Risks in the organization
      • Risks in IT context.
      • Security as an Investment
      • Business-Driven Security Program
      • Governance and Control.
      • Information Security Policy Basics
      Agenda
      3
      Exam weight Low

        Risks in Business

        Risks in Business
        4
        Exam weight Low
        1. Every business decision carries risk; security exists to support business goals, not the other way round.
        Slide 5: Why Care About Cyber Risk?
        Exam weight Low

          Why Care About Cyber Risk?

          • 91% of Board Members at the most vulnerable companies can't interpret a cybersecurity report. (Nasdaq report)
          • The knowledge gap between executives and IT must be bridged.
            • First, identify why cyber risk should be a business priority for any executive.
            • The goal isn’t to turn CEOs, CFOs and other business leaders into technologists, but for businesses to adapt to the digital landscape in which they exist.
            • requires effort from both management and IT to find middle ground in a relationship that has often been difficult
          Why Care About Cyber Risk?
          6
          Exam weight Low
            Slide 7: Why Care About Cyber Risk?
            Exam weight Low
              Slide 8: Manage and Capitalize on Risk
              Exam weight Low

                IT Risk and IT Value

                • VAL IT: is a governance framework that can be used to create business value from IT investments.
                • RISK IT: provides an end-to-end, comprehensive view of all risks related to the use of information technology (IT).
                • COBIT: is to provide management and business process owners with an information technology (IT) governance model that helps in delivering value from IT and understanding and managing the risks associated with IT.
                IT Risk and IT Value
                9
                Exam weight Low
                1. IT risk is the flip side of IT value: managing risk protects the value IT creates.
                ★ Past exam
                Slide 10: Risk IT Extends Val IT and COBIT
                Exam weight High
                1. Risk IT extends Val IT and COBIT (ISACA frameworks) to cover IT-related business risk.

                Asked in a real exam

                ★ Quiz 1, Term 222 · the framework for compliance, risk and IT alignment
                🎯 How this can come up · 1 question
                MCQ

                Which framework helps organizations with regulatory compliance, risk management and aligning IT strategy with business goals?

                Slide 11: Where IT Risk Fits In
                Exam weight Low
                  ★ Past exam
                  Slide 12: Cybersecurity TRIAD
                  Exam weight High
                  1. CIA triad: Confidentiality (only authorized people see it), Integrity (not altered improperly), Availability (there when needed).

                  Asked in a real exam

                  ★ Quiz 1, Term 222 · only those supposed to access the data can
                  🎯 How this can come up · 1 question
                  MCQ

                  Making sure only those who are supposed to access the data can access it is:

                  Slide 13: Business-Driven Security
                  Exam weight Low
                  1. Business-driven security: start from business requirements and risk appetite, then choose controls.
                  ★ Past exam

                  Cybersecurity Management

                  Cybersecurity Management
                  14
                  Exam weight High
                  1. Management support is the most important factor for a successful security program.

                  Asked in a real exam

                  ★ Quiz 1, Term 222 · the most important factor for security to succeed
                  🎯 How this can come up · 1 question
                  MCQ

                  The most important factor in ensuring security succeeds in an organization is:

                  Slide 15: Organizational & Business Requirements
                  Exam weight Low
                    Slide 16: Cybersecurity Security Solutions
                    Exam weight Low
                      Slide 17: Cybersecurity Management
                      Exam weight Low
                        Slide 18: Cybersecurity Management
                        Exam weight Low
                          ★ Past exam
                          Slide 19: Cybersecurity Governance
                          Exam weight High
                          1. Governance: the board and executives set direction, accountability and oversight; management executes.

                          Asked in a real exam

                          ★ Quiz 2 · who should be involved in security risk management
                          🎯 How this can come up · 1 question
                          Written

                          Why should executives and IT/security teams communicate well?

                          Slide 20
                          20
                          Exam weight Low
                            ★ Past exam

                            Cybersecurity Governance

                            • Fully integrated into overall risk analysis/management.
                            • Ensure that IT infrastructure:
                              • Meets all requirements.
                              • Supports the strategies and objectives of the company.
                              • Includes service level agreements [if outsourced].
                            Cybersecurity Governance
                            21
                            Exam weight High
                            1. Data owner (a senior manager) decides the classification level of information; the custodian implements the protection.
                            Exam trapOwner DECIDES classification; custodian (IT) IMPLEMENTS controls; auditors MEASURE effectiveness.

                            Asked in a real exam

                            ★ Quiz 1, Term 222 · who decides the classification levelMajor exam · the person in charge of a data domain
                            🎯 How this can come up · 2 questions
                            MCQ

                            Who has primary responsibility for determining the classification level of information?

                            MCQ

                            Who should measure the effectiveness of information-security controls?

                            Slide 22: Security Blueprints
                            Exam weight Low
                              ★ Past exam
                              Slide 23: Policy Overview
                              Exam weight High
                              1. Policies: high-level management statements of what must be protected and why (mandatory, technology-neutral).

                              Asked in a real exam

                              ★ Quiz 1, Term 222 · what security policies are
                              🎯 How this can come up · 1 question
                              MCQ

                              Security policies are best described as:

                              Slide 24: Slide 24
                              Exam weight Low

                                Security Statement Example

                                Security Statement Example
                                25
                                Exam weight Low
                                  Slide 26: Slide 26
                                  Exam weight High
                                  1. Hierarchy: policy (why) → standards (mandatory what) → procedures (step-by-step how) → baselines (minimum level) → guidelines (optional advice).
                                  Memory trickPolicy = WHY, Standard = WHAT (mandatory), Procedure = HOW, Baseline = MINIMUM, Guideline = SHOULD.
                                  🎯 How this can come up · 2 questions
                                  MCQ

                                  Detailed step-by-step instructions for a task are:

                                  MCQ

                                  Recommended but optional actions are:

                                  Slide 27: Slide 27
                                  Exam weight Low
                                  1. Data classification groups data by sensitivity (e.g. public, internal, confidential, secret) so each level gets suitable controls.
                                  Slide 28: Slide 28
                                  Exam weight Low
                                    Slide 29: Slide 29
                                    Exam weight Low
                                      Slide 30: Slide 30
                                      Exam weight Low
                                        Slide 31: Slide 31
                                        Exam weight Low
                                          ★ Past exam
                                          Slide 32: Slide 32
                                          Exam weight High
                                          1. Planning horizons: strategic (long term, 3–5 years), tactical (mid term, 6 months–1 year or more), operational (short term, day to day to ~6 months).

                                          Asked in a real exam

                                          ★ Quiz 2 · Renee’s one-to-six-month plan
                                          🎯 How this can come up · 1 question
                                          MCQ

                                          A short-term security plan with a one- to six-month horizon is:

                                          ★ Past exam
                                          Slide 33: Risk Management
                                          Exam weight High
                                          1. Functionality = what a security mechanism does; assurance = the confidence that it does it correctly.

                                          Asked in a real exam

                                          ★ Quiz 1, Term 222 · functionality vs. assurance
                                          🎯 How this can come up · 1 question
                                          MCQ

                                          Security functionality defines what a mechanism does; assurance defines:

                                          “Security Transcends Technology”

                                          Slide 34
                                          34
                                          Exam weight Low