Jyteris Horne
Information Security Fund
Mr. Everett

Chapter 4: Case Project 1-20 1. It is the process of identifying risk represented by vulnerabilities to an organizations information assets and infrastructure. Also taking steps to reduce this risk to an acceptable level. 2. The two key understandings are knowing yourself and knowing the enemy. 3. Security professionals are responsible for risk management in an organization. The IT community takes the lead in information security risk management. 4. Threats are constantly changing for a company and also once any specific vulnerability is completely managed by an existing control it no longer needs to be considered for additional controls. 5. Networking components need more examination from an information security perspective than from a systems development perspective because networking subsystems are often the focal point of attacks against the system. 6. All hardware components are already identified, make and locations, and management can review for the most critical items and assess the values. 7. The IP-address for network device. 8. Comprehensive is more important than mutual. 9. The difference is generating revenue refers to the asset producing a cash flow that is linked directly to the asset. If the assets weren’t there then no money would be made. Assets that generate profit don’t produce cash directly. 10. Vulnerability is a weakness in a controlled system where controls are not present or no longer effective. It can be noticed by any kind of threat or weak spot. 11. It is the state of falling behind the competition. It has emerged as a factor because business which does not stay on the cutting edge of IT can quickly fall behind the competition given to them. 12. Evaluation, assessment, and maintenance are controlling risk in this chapter. 13. The