CoreQ Academy1.2 Given a set of organizational security requirements, perform risk management activities.
Advanced risk management plans for severe but plausible scenarios, manages third parties and ties confidentiality, integrity, availability and privacy risks to concrete controls.
Impact analysis
- Extreme but plausible scenarios
- Stress-testing plans against severe events that could realistically happen, such as a destructive ransomware attack on all domain controllers.
Risk assessment and management
- Quantitative vs. qualitative analysis
- Numbers and money (SLE, ALE) versus ratings and judgment; mature programs combine both.
- Risk assessment frameworks
- Structured methods such as NIST SP 800-30, ISO 27005 or FAIR.
- Appetite/tolerance
- How much risk the organisation will accept overall and the acceptable variation for specific risks.
- Risk prioritization
- Ordering risks by likelihood, impact and appetite.
- Severity impact
- How badly a risk would hurt operations, finances, reputation or safety.
- Remediation
- Actions taken to reduce the risk.
- Validation
- Confirming remediation actually reduced the risk.
Third-party risk management
- Supply chain risk
- Risk from components and services your products depend on.
- Vendor risk
- Risk from the security posture of suppliers you contract with.
- Subprocessor risk
- Risk from your vendors' own vendors who process your data.
Availability risk considerations
- Business continuity/disaster recovery
- Plans to keep operating and to restore IT after disruption.
- Testing
- Exercises and failover tests that prove plans work.
- Backups
- Copies that enable recovery.
- Connected
- Online backups: fast to restore but reachable by attackers.
- Disconnected
- Offline, air-gapped or immutable backups that ransomware cannot reach.
Confidentiality risk considerations
- Data leak response
- Prepared steps to contain, assess and notify after a leak.
- Sensitive/privileged data breach
- Higher-impact breaches involving regulated data or privileged credentials.
- Incident response testing
- Exercising the IR plan for confidentiality incidents.
- Reporting
- Meeting legal and contractual breach notification deadlines.
- Encryption
- Reduces confidentiality impact if data is stolen.
Integrity risk considerations
- Remote journaling
- Sending transaction journals to a remote site in real time so data can be reconstructed.
- Hashing
- Detecting unauthorised changes.
- Interference
- Disruption or manipulation of data or signals that undermines integrity.
- Antitampering
- Physical and logical controls that detect or prevent tampering.
Privacy risk considerations
- Data subject rights
- Rights such as access, correction, deletion and objection under privacy law.
- Data sovereignty
- Laws of the country where data is stored apply to it.
- Biometrics
- Highly sensitive personal data that cannot be changed if compromised; often specially regulated.
Crisis and breach response
- Crisis management
- Leadership-level coordination of major incidents: decisions, communications, legal and business continuity.
- Breach response
- The specific process for investigating, containing and notifying after a data breach.
Check your understanding
Loading quiz…
Original CoreQ Academy material, mapped to objective 1.2 of the publicly available CompTIA SecurityX CAS-005 exam objectives (Exam objectives V5, document version 7.0). Not affiliated with or endorsed by CompTIA. Contains no exam questions.