Last Attempt CRISC Questions

The first course of action for a risk practitioner when discovering a deficiency in a critical system that cannot be patched is to conduct a risk assessment. A risk assessment is a process of identifying, analyzing, and evaluating the risks that could affect the achievement of the objectives of the system or the organization. A risk assessment helps to determine the level and nature of the risk exposure, and to prioritize and respond to the risks. Conducting a risk assessment is the first course of action, as it helps to understand the source, cause, and impact of the deficiency, and to estimate the likelihood and consequences of the risk events that could exploit the deficiency. Conducting a risk assessment also helps to identify and evaluate the existing or potential controls or mitigations that could address the deficiency, and to recommend the appropriate risk treatment options. Reporting the issue to internal audit, submitting a request to change management, and reviewing the business impact assessment are not the first courses of action, as they are either the outputs or the inputs of the risk assessment process, and they do not address the primary need of assessing the risk situation and status. References = CRISC Review Manual, 6th Edition, ISACA, 2015, page 49.

A cause-and-effect diagram, also known as a fishbone diagram or an Ishikawa diagram, is a graphical tool that helps to identify and analyze the potential causes and effects of a problem or an event. A cause-and-effect diagram can be used to develop technical risk scenarios related to a recently developed ERP system, because it can help to:

Break down the complex problem or event into manageable and measurable categories and subcategories of causes and effects

Visualize the relationships and interactions among the various factors that contribute to the problem or event

Identify the root causes and the most significant effects of the problem or event

Generate ideas and hypotheses for testing and validating the problem or event

Communicate and present the problem or event clearly and logically to the stakeholders1

A cause-and-effect diagram can be constructed by following these steps:

Define the problem or event and write it in a box on the right side of the diagram

Draw a horizontal line from the box to the left side of the diagram, representing the main spine of the fishbone

Identify the major categories of causes that affect the problem or event, such as people, process, technology, environment, etc., and write them on the branches of the spine

For each category, brainstorm and list the possible subcategories and specific causes that influence the problem or event, and write them on the sub-branches of the spine

For each cause, identify and list the possible effects or consequences that result from the problem or event, and write them on the sub-sub-branches of the spine

Analyze the diagram and prioritize the causes and effects based on their frequency, severity, and controllability

Develop technical risk scenarios based on the most critical causes and effects, and describe how they could affect the ERP system and the organization1

The data owner is the person who has the authority and responsibility to classify, label, and protect the information assets of the organization. The data owner is accountable for the risk of potential loss of confidential information, as they are the ones who determine the level of protection and access required for the data. The risk manager is responsible for identifying, assessing, and mitigating the risks that may affect the organization, but they are not accountable for the data itself. The end user is the person who uses the information assets for their operational tasks, but they are not accountable for the data protection or classification. The IT department is responsible for providing the technical support and infrastructure for the information assets, but they are not accountable for the data ownership or risk management. References = Risk and Information Systems Control Study Manual, Chapter 2: IT Risk Assessment, Section 2.3: Data Classification, p. 69-70.

User accounts provisioning is the process of creating, managing, and modifying user accounts within a system or an application, based on the user’s roles, responsibilities, and requirements. User accounts provisioning is an essential part of identity and access management (IAM), which aims to ensure the confidentiality, integrity, and availability of the system or the application, and the information or resources that it handles or supports1.

The best key performance indicator (KPI) for monitoring adherence to an organization’s user accounts provisioning practices is the percentage of accounts without documented approval, because it can help to measure how well the organization follows the policies, standards, and procedures for user accounts provisioning, and how effectively the organization controls and audits the user accounts provisioning activities. The percentage of accounts without documented approval can indicate:

The level of compliance and accountability of the user accounts provisioning process, and the extent to which the user accounts provisioning requests and actions are authorized and verified by the appropriate parties, such as managers, IT staff, or security officers

The level of risk and exposure of the user accounts provisioning process, and the likelihood and impact of unauthorized or inappropriate user accounts provisioning, such as granting excessive or unnecessary access privileges, creating duplicate or fraudulent accounts, or violating legal or regulatory requirements

The level of quality and efficiency of the user accounts provisioning process, and the ability and capacity of the organization to manage and maintain the user accounts provisioning records and documents, such as forms, logs, or reports23

The other options are not the best KPIs for monitoring adherence to an organization’s user accounts provisioning practices, but rather some of the factors or outcomes of it. User accounts with default passwords are user accounts that have not changed their passwords from the initial or default values that are assigned by the system or the application. User accounts with default passwords are a factor that can increase the risk of unauthorized or malicious access to the system or the application, as the default passwords may be easily guessed or compromised by attackers. Active accounts belonging to former personnel are user accounts that have not been deactivated or deleted after the users have left the organization. Active accounts belonging to former personnel are an outcome of ineffective or inefficient user accounts deprovisioning, which is the process of revoking or removing the user accounts and access privileges when they are no longer needed or valid. Accounts with dormant activity are user accounts that have not been used or accessed for a long period of time. Accounts with dormant activity are an outcome of poor or inconsistent user accounts management, which is the process of updating or modifying the user accounts and access privileges according to the changes or needs of the users or the organization4. References =

User Provisioning for SaaS Apps: Top 10 Best Practices | Resmo

Top Identity and Access Management Metrics

KPI-driven approach to Identity & Access Management - Elimity

[CRISC Review Manual, 7th Edition]