What is risk management? Why is the identification of risks and vulnerabilities to assets so important in risk management?

According to Sun Tzu, what two key understandings must you achieve to be successful in battle?

Who is responsible for riskmanagement in an organization? Which community of

interest usually takes the lead in information security risk management?

In risk management strategies, why must periodic review be part of the process?

Why do networking components need more examination from an information security perspective than from a systems development perspective?

What value does an automated asset inventory system have during risk identification?

What information attribute is often of great value for local networks that use staticaddressing?

When devising a classification scheme for systems components, is it more important that the asset identification list be comprehensive or mutually exclusive?

What's the difference between an asset's ability to generate revenue and its ability to generate profit?

What are vulnerabilities? How do you identify them?

What is competitive disadvantage? Why has it emerged as a factor?

What five strategies for controlling risk are described in this chapter?

Describe the defense strategy for controlling risk. List and describe the three common methods.

Describe the transfer strategy for controlling risk. Describe how outsourcing can be used for this purpose.

Describe the mitigation strategy for controlling risk. What three planning approaches are discussed in the text as opportunities to mitigate risk?

How is an incident response plan different from a disaster recovery plan?

What is risk appetite? Explain why it varies among organizations.

What is a cost$-$benefit analysis?

What is single loss expectancy? What is annualized loss expectancy?

What is residual risk?