Cybersecurity Risk Assessments

Upon successful completion of this course, participants will be able to:

Recognize why cybersecurity risk assessments must be connected to business strategy.
• Recall the indicators of a material cyber issue.
• Recognize the value of mapping business processes during an assessment.
• Specify the reasons for documenting assessment scope issues.
• Recall why data classification is needed in an assessment.
• Recognize the risks associated with asset inventory practices.
• Recall why configuration records are needed in an assessment.
• Recognize why cloud data concentration can be a risk for an organization.
• Specify the uses of threat intelligence in a risk assessment.
• Recall why social engineering is a risk.
• Recognize the conditions that can increase ransomware exposure.
• Recall the nature of a cascading cyber risk.
• Recognize the nature of a single-point failure.
• Specify the issues associated with an impact analysis.
• Recall the problems with quantitative risk methods.
• Recognize why existing controls should be evaluated in an assessment.
• Recall why control operation is as important as control design.
• Recognize the different types of access practices, and when to use them.
• Specify the risks associated with deprovisioning.
• Recall the issues with the use of shared credentials.
• Recognize the risks associated with remote access.
• Recall the issues associated with data retention.
• Recognize why backup protection must be included in an assessment.
• Specify the issues related to network architecture risk.
• Recall how hardening can be accomplished.
• Recognize the risks associated with legacy systems.
• Recall the risks related to application programming interfaces.
• Recognize the issues related to the use of SaaS applications.
• Specify the concerns with fourth-party dependencies.
• Recall why vendor concentration should be reviewed as part of an assessment.
• Recognize the issues that can increase the level of human-factor cyber risk.
• Recall the benefits of using well-defined incident reporting channels.