Information Security Management Examination (SG) | Section A Risk and Access Management 05

The answer is risk avoidance, the response of stopping the activity or the use of the asset that causes the risk in the first place.

The answer is risk mitigation, the response of introducing controls to make the likelihood or the impact smaller.

The answer is risk transfer, the response of passing part of the loss to a third party through insurance or a contract.

The answer is risk retention, the response of accepting a recognised risk in view of the cost of countermeasures and the like.

The answer is risk owner, the person who manages a particular risk and has the accountability and authority for responding to it.

The answer is residual risk, the risk that remains after controls have been implemented.

The answer is threat, an event or presence that could cause harm to information assets.

The answer is vulnerability, a weakness in an asset or a control that a threat could exploit.

The answer is asset inventory, a record listing where information assets are, who manages them and how important they are.

The answer is information classification, sorting information by importance such as its confidentiality and setting rules for handling it.

The answer is principle of least privilege, granting only the minimum access rights needed for the job.

The answer is separation of duties, the control of assigning tasks such as requesting and approving to different people to curb fraud and error.

The answer is privileged ID management, strictly controlling who uses IDs with administrator rights, for what purpose, for how long and with what operations recorded.

The answer is account review, periodically confirming that users and their rights are still appropriate and removing those no longer needed.

The answer is password spraying, an attack that tries a small number of common passwords against many IDs.

The answer is credential stuffing, an attack that reuses ID and password pairs leaked from another service to attempt logins.

The answer is man-in-the-middle attack, an attack that gets between two communicating parties to eavesdrop or tamper.

The answer is DNS cache poisoning, an attack that plants false information in a DNS cache to send users to a malicious site.

The answer is session hijacking, an attack that steals a valid session identifier to impersonate a legitimate user.

The answer is CSRF, an attack that makes a logged-in user send an unintended request to a website.