CRISC Exam Dumps - Certified in Risk and Information Systems Control

 A risk heat map is a visualization tool that shows the likelihood and impact of different risks on a matrix, using colors to indicate the level of risk. A risk heat map can help prioritize the risks that need the most attention and resources, and support the decision making and planning process for risk management. Mapping open risk issues to an enterprise risk heat map best facilitates risk response, which is the process of selecting and implementing the appropriate actions to address the risks. Risk response can include strategies such as mitigating, transferring, avoiding, or accepting risks. By mapping open risk issues to a risk heat map, an organization can identify the most suitable risk response for each risk, based on the risk appetite, criteria, and objectives. A risk heat map can also help evaluate the effectiveness and efficiency of the risk response, by showing the change in the level of residual risk after the risk response has been executed. References = What Is a Risk Heat Map & How Can It Help Your Risk Management Strategy, What Is a Risk Heat Map, and How Can It Help Your Risk Management Strategy, Risk Map (Risk Heat Map), How To Use A Risk Heat Map.

The risk owner is the person who should be accountable for any related losses to the organization, because they are the person who has the authority and responsibility to manage the risk and its associated controls.The risk owner is also the person who accepts the risk and its residual level, and who monitors and reports on the risk status and performance. The IT risk manager, the server administrator, and the risk practitioner are all involved in the riskmanagement process, but they are not the person who should be accountable for the risk and its outcomes, as they do not have the ultimate decision-making power and accountability for therisk. References = Risk and Information Systems Control Study Manual, Chapter 3, Section 3.1.1, page 79

Automated IT asset management ensures real-time visibility and tracking of software usage, licensing, and compliance. It minimizes human error, improves audit readiness, and proactively addresses noncompliance risks.

The risk of terminated employee accounts maintaining access is that the former employees or unauthorized parties may use the accounts to access or manipulate the organization’s information systems or resources, and cause harm or damage to the organization and its stakeholders, such as data loss, data breach, system failure, fraud, etc.

The first step to address the risk of terminated employee accounts maintaining access is to disable user access, which means to revoke or remove the permissions or privileges that allow the accounts to access or use the organization’s information systems or resources. Disabling user access can help the organization to address the risk by providing the following benefits:

It can prevent or stop the former employees or unauthorized parties from accessing or using the organization’s information systems or resources, and reduce or eliminate the potential harm or damage that they may cause for the organization and its stakeholders.

It can ensure the confidentiality, integrity, availability, and reliability of the organization’s information systems or resources, and protect them from unauthorized access or manipulation.

It can provide useful evidence and records for the verification and validation of the organization’s access control function, and for the compliance with the organization’s access control policies and standards.

The other options are not the first steps to address the risk of terminated employee accounts maintaining access, because they do not provide the same level of urgency and effectiveness that disabling user access provides, and they may not be sufficient or appropriate to address the risk.

Performing a risk assessment is a process of measuring and comparing the likelihood and impact of various risk scenarios, and prioritizing them based on their significance and urgency.Performing a risk assessment can help the organization to understand and document the risk of terminated employee accounts maintaining access, but it is not the first step to address the risk, because it does not prevent or stop the former employees or unauthorized parties from accessing or using the organization’s information systems or resources, and it may not be timely or feasible to perform a risk assessment before disabling user access.

Developing an access control policy is a process of defining and describing the rules or guidelines that specify the expectations and requirements for the organization’s access control function, such as who can access what, when, how, and why. Developing an access control policy can help the organization to establish and communicate the boundaries and objectives for the organization’s access control function, but it is not the first step to address the risk, because it does not prevent or stop the former employees or unauthorized parties from accessing or using the organization’s information systems or resources, and it may not be relevant or applicable to the existing or emerging risk scenarios that may affect the organization’s access control function.

Performing a root cause analysis is a process of identifying and understanding the underlying or fundamental causes or factors that contribute to or result in a problem or incident that has occurred or may occur in the organization. Performing a root cause analysis can help the organization to address and correct the risk of terminated employee accounts maintaining access, and prevent or reduce its recurrence or impact, but it is not the first step to address the risk, because it does not prevent or stop the former employees or unauthorized parties from accessing or using the organization’s information systems or resources, and it may not be timely or feasible to perform a root cause analysis before disabling user access. References =

ISACA, CRISC Review Manual, 7th Edition, 2022, pp. 40-41, 47-48, 54-55, 58-59, 62-63

ISACA, CRISC Review Questions, Answers & Explanations Database, 2022, QID 207

CRISC Practice Quiz and Exam Prep

The primary reason for periodic penetration testing of Internet-facing applications is to identify vulnerabilities in the system, because this will help to improve the security and resilience of the applications and the data they process. A penetration test is a simulated cyberattack that aims to exploit the weaknesses and gaps in the security of an application or a system. A penetration test can reveal the vulnerabilities that may not be detected by other methods, such as automated scanning or code review. A penetration test can also measure the impact and severity of the vulnerabilities, as well as the effectiveness of the existing controls and defenses. A penetration test can also provide recommendations and solutions to remediate the vulnerabilities and prevent future attacks. Internet-facing applications are programs and services that are accessible from the internet, such as web applications, APIs, cloud services, or VPN gateways. Internet-facing applications are exposed to a variety of cyber threats, such as denial-of-service attacks, SQL injection attacks, cross-site scripting attacks, or credential stuffing attacks. These threats can compromise the confidentiality, integrity, and availability of the applications and the data they handle. Therefore, periodic penetration testing of Internet-facing applications is essential to identify vulnerabilities in the system and to protect the applications and the data from cyberattacks. References = Web Application Penetration Testing: A Practical Guide - BrightSecurity1, The Basics of Web Application Penetration Testing | Turing2, Periodic Penetration Testing: What is the best pentesting frequency …

An intrusion detection system (IDS) is a network security tool that monitors network traffic and devices for known malicious activity, suspicious activity or security policy violations1. An IDS can generate alerts when it detects any potential threats, but not all alerts are accurate or relevant. There are two types of errors that can affect the performance and reliability of an IDS: false positives and false negatives2.

A false positive is when an IDS incorrectly flags a benign or normal activity as malicious or suspicious. For example, an IDS may alert on a legitimate network scan or a harmless software update. False positives can reduce the credibility and efficiency of an IDS, as they can overwhelm the security team with unnecessary alerts, distract them from the real threats, and cause them to ignore or disable the IDS3.

A false negative is when an IDS fails to flag a malicious or suspicious activity as such. For example, an IDS may miss a stealthy or novel attack that does not match any known signatures or patterns. False negatives can compromise the security and integrity of the network, as they can allow attackers to bypass the IDS and cause damage or steal data without being detected4.

The risk practitioner should recommend to analyze the alerts to minimize the false positives, because this is the best way to improve the accuracy and usefulness of the IDS. By analyzing the alerts, the risk practitioner can:

Identify the sources and causes of the false positives, such as misconfigured or outdated IDS rules, network anomalies, or legitimate traffic that resembles malicious traffic5.

Adjust or fine-tune the IDS settings, such as the alert threshold, the sensitivity level, the detection method, or the rule base, to reduce the number of false positives without increasing the risk of false negatives.

Validate or verify the alerts with other sources of information, such as logs, network traffic analysis, or threat intelligence, to confirm or dismiss the alerts as true or false positives.

Prioritize or classify the alerts based on their severity, impact, or likelihood, to focus on the most critical or relevant alerts and avoid alert fatigue.

The other options are not the best course of action, because:

Resetting the alert threshold based on peak traffic is not a reliable or effective way to minimize the false positives, as it may also increase the risk of false negatives. The alert threshold is the level of activity or deviation that triggers an alert from the IDS. If the threshold is set too high, the IDS may miss some malicious or suspicious activity that occurs below the threshold. If the threshold is set too low, the IDS may generate too many alerts for normal or benign activity that exceeds the threshold. The optimal threshold depends on various factors, such as the network size, topology, traffic volume, and baseline. Peak traffic is not a good indicator of the optimal threshold, as it may vary depending on the time, day, or season, and it may not reflect the normal or expected network behavior.

Analyzing the traffic to minimize the false negatives is not the main issue or goal in this scenario, as the problem is the high number of alerts, not the low number of alerts. Analyzing thetraffic can help to identify the malicious or suspicious activity that the IDS may have missed, but it does not address the root cause of the false positives or improve the IDS performance. Moreover, analyzing the traffic can be time-consuming and resource-intensive, especially for large or complex networks, and it may require specialized tools or skills that the risk practitioner may not have.

Sniffing the traffic using a network analyzer is not a suitable or feasible option in this scenario, as it may violate the privacy or security policies of the network or the organization. Sniffing the traffic means capturing and inspecting the network packets that are transmitted or received by the devices on the network. A network analyzer is a tool that can perform this function and display the packet data in a readable format. However, sniffing the traffic can also expose sensitive or confidential information, such as passwords, usernames, or credit card numbers, that may be contained in the packets. Therefore, sniffing the traffic may require authorization or consent from the network owners or users, and it may be restricted or prohibited by law or regulation.

References =

What is an intrusion detection system (IDS)? - IBM

Intrusion detection system - Wikipedia

What Are Intrusion Detection Systems? - MUO

12 Best Intrusion Detection System (IDS) Software 2024 - Comparitech

What is an Intrusion Detection System (IDS)? - Fortinet

[False Positive and False Negative in Intrusion Detection System]

[False Positives and False Negatives in Intrusion Detection Systems]

[How to Reduce False Positives for Your IDS/IPS]

[How to Set the Right Alert Thresholds for Your IDS/IPS]

[Network Traffic Analysis: What It Is and How It Works]

[What is a Network Analyzer? - Definition from Techopedia]