Isaca Certification CRISC Book

Cybersecurity Awareness Program:

Phishing Simulations: These exercises are designed to test employees’ ability to recognize and respond to phishing attempts. They serve as a deterrent by raising awareness and making employees more vigilant.

Deterrent Controls:

Definition: Deterrent controls are designed to discourage potential attackers or risky behavior by creating awareness of consequences.

Application: Phishing simulations act as deterrent controls by educating employees and reducing the likelihood of successful phishing attacks through increased awareness.

Comparison with Other Options:

Preventive: Preventive controls aim to stop incidents before they occur. Phishing simulations do not prevent but rather educate.

Detective: Detective controls identify and respond to incidents after they occur. Phishing simulations are proactive rather than reactive.

Compensating: Compensating controls provide alternative measures when primary controls are not feasible. Phishing simulations are not compensating but directly address phishing risk.

Best Practices:

Regular Simulations: Conduct regular phishing simulations to maintain high levels of awareness.

Feedback and Training: Provide immediate feedback and additional training to employees who fail simulations.

References:

Sybex CISSP Official Study Guide: Details how phishing simulations serve as deterrent controls by educating and preparing employees against phishing attacks .

CRISC Review Manual: Discusses the role of awareness programs and simulations in enhancing security posture through deterrent measures .

Conducting a risk assessment with stakeholders is the best course of action for the risk practitioner to evaluate the adoption of a third-party blockchain integration platform, because it helps to identify, analyze, and evaluate the risks and opportunities associated with the platform, and to compare them with the organization’s risk appetite and value proposition. A risk assessment is a process of systematically identifying and assessing the sources and types of risk that an organization faces, and estimating their likelihood and impact. A risk assessment also involves identifying and evaluating the existing or proposed controls or mitigating factors that can reduce or eliminate the risk. A stakeholder is a person or group that has an interest or influence in the organization or its activities, such as customers, employees, shareholders, suppliers, regulators, or partners. A blockchain integration platform is a software solution that enables the organization to connect and interact with blockchain networks or applications, such as cryptocurrencies, smart contracts, or distributed ledgers. A blockchain integration platform can offer benefits such as transparency, security, efficiency, and innovation, but it can also pose risks such as technical complexity, interoperability issues, regulatory uncertainty, or cyberattacks. Therefore, conducting a risk assessment with stakeholders is the best way to evaluate the adoption of a third-party blockchain integration platform, as it helps to understand the benefits and risks of the platform, and to align them with the organization’s objectives and risk appetite. Conducting third-party resilience tests, updating the risk register with the process changes, and reviewing risk related to standards and regulations are all important tasks to perform after conducting a risk assessment, but they are not the best course of action, as they depend on the results of the risk assessment. References = Risk and Information Systems Control Study Manual, Chapter 3, Section 3.2.2, page 87

Risk capacity is the amount of risk that an organization can financially afford to take, without jeopardizing its ability to meet its objectives or obligations. Risk capacity is determined by factors such as the organization’s income, assets, liabilities, and cash flow. An organization that has built up its cash reserves has increased its risk capacity, as it has more financial resources and flexibility to support additional risk. This may enable the organization to pursue more opportunities or initiatives that involve higher risk and higher reward.

Risk profile is a summary of the key risks that an organization faces, and their implications for the organization’s objectives and strategy. Risk profile may change due to factors such as new technologies, business initiatives, or external events, but not necessarily due to changes in cash reserves.

Risk indicators are metrics or indicators that help to monitor and evaluate the likelihood or impact of a risk, or the effectiveness or efficiency of a control. Risk indicators may vary depending on the risk sources, scenarios, or responses, but not necessarily due to changes in cash reserves.

Risk tolerance is the amount of risk that an organization is willing to accept, based on its risk appetite and risk capacity. Risk tolerance is influenced by factors such as the organization’s culture, values, and objectives, as well as the risk environment and expectations. Risk tolerance may change due to changes in cash reserves, but it is not the most likely impact, as it also depends on the organization’s risk appetite and other factors.

Residual risk exceeds acceptable limits, because it indicates that the risk level is higher than the organization’s risk appetite or tolerance, and that the risk responses and controls are insufficient or ineffective. Residual risk is the level of risk remaining in a process or procedure following the implementation of risk controls to limit or remove it. Escalation is a process that increases the awareness and involvement of higher-level stakeholders or authorities in a risk issue or situation. Escalation is appropriate when the risk issue or situation is outside the scope or authority of the current risk owner or manager, and requires the attention or action of the senior management or the board of directors. Residual risk exceeding acceptable limits is the best situation to justify escalation, as it implies that the current risk owner or manager cannot manage the risk within the predefined boundaries or expectations, and that the senior management or the board of directors need to intervene or approve the risk acceptance or transfer.

Residual risk being inadequately recorded, residual risk remaining after controls have been applied, and residual risk equaling current risk are all possible situations that may require escalation, but they are not the best situations, as they do not necessarily indicate that the risk level is higher than the acceptable limits, and that the senior management or the board of directors need to be involved.