Four questions for credit to be given: (1) (Reference Chapter 12 of \"Project Ri

Question

Four questions for credit to be given:

(1) (Reference Chapter 12 of "Project Risk Management" text) Briefly describe risk management/control processes from two of the four approach sources (AZ/NZS, PMBOK, PRAM and M_o_R), contrasting pros and cons.

(2) What is a Risk Watch List? How is this applied in project risk management?

(3) Define and describe denial of service (DOS) and distributed denial of service (DDOS) attacks. Which is more difficult to prevent? Why?

(4) Identify and describe characteristics of

Explanation / Answer

1ans;

this can be verifed in 4th ans

2 ans;. A list of securities being monitored closely by a brokerage or exchange in order to spot irregularities. Firms on the watch list might be suspected of regulatory violations, about to issue new securities, attracting usually heavy volume, etc. 2. A list of securities being monitored for potential trading or investing opportunities. An investor or trader may have a watch list of several, dozens or even hundreds of trading instruments. The investor waits for certain criteria to be met--such as trading over a certain volume, breaking out of a 52-week range or moving above its 200-day moving average--before placing trade orders. 1. A watch list is a used to specify companies where irregularities are present, or where the potential for insider trading or other corruption exists. The watch list can be considered a surveillance tool used to identify risks from customers, consultants, suppliers and other business partners. 2. Many trading platforms give investors and traders the opportunity to create watch lists and screen, or filter, for certain conditions to be met. The user can specify both fundamental and technical criteria in an attempt to find high probability trading or investing opportunities. The watch list may provide an alert, such as an audible alert, text message or email, that warns the user that conditions are about to be met or have been met

.3 ans

;In a denial-of-service (DoS) attack, an attacker attempts to prevent legitimate users from accessing information or services. By targeting your computer and its network connection, or the computers and network of the sites you are trying to use, an attacker may be able to prevent you from accessing email, websites, online accounts (banking, etc.), or other services that rely on the affected computer.

A distributed denial-of-service (DDoS) attack is one in which a multitude of compromised systems attack a single target, thereby causing denial of service for users of the targeted system. The flood of incoming messages to the target system essentially forces it to shut down, thereby denying service to the system to legitimate users.

In a typical DDoS attack, the assailant begins by exploiting a vulnerability in one computer system and making it the DDoS master. The attack master, also known as the botmaster, identifies and identifies and infects other vulnerable systems with malware. Eventually, the assailant instructs the controlled machines to launch an attack against a specified target.

There are two types of DDoS attacks: a network-centric attack which overloads a service by using up bandwidth and an application-layer attack which overloads a service or database with application calls. The inundation of packets to the target causes a denial of service. While the media tends to focus on the target of a DDoS attack as the victim, in reality there are many victims in a DDoS attack -- the final target and as well the systems controlled by the intruder. Although the owners of co-opted computers are typically unaware that their computers have been compromised, they are nevertheless likely to suffer a degradation of service and not work well.

4 ans;;

A widely used vocabulary for risk management is defined by ISO Guide 73, "Risk management. Vocabulary."[2]

In ideal risk management, a prioritization process is followed whereby the risks with the greatest loss (or impact) and the greatest probability of occurring are handled first, and risks with lower probability of occurrence and lower loss are handled in descending order. In practice the process of assessing overall risk can be difficult, and balancing resources used to mitigate between risks with a high probability of occurrence but lower loss versus a risk with high loss but lower probability of occurrence can often be mishandled.

Intangible risk management identifies a new type of a risk that has a 100% probability of occurring but is ignored by the organization due to a lack of identification ability. For example, when deficient knowledge is applied to a situation, a knowledge risk materializes. Relationship risk appears when ineffective collaboration occurs. Process-engagement risk may be an issue when ineffective operational procedures are applied. These risks directly reduce the productivity of knowledge workers, decrease cost-effectiveness, profitability, service, quality, reputation, brand value, and earnings quality. Intangible risk management allows risk management to create immediate value from the identification and reduction of risks that reduce productivity.

Risk management also faces difficulties in allocating resources. This is the idea of opportunity cost. Resources spent on risk management could have been spent on more profitable activities. Again, ideal risk management minimizes spending (or manpower or other resources) and also minimizes the negative effects of risks.

Method ;

For the most part, these methods consist of the following elements, performed, more or less, in the following order.

identify, characterize threats

assess the vulnerability of critical assets to specific threats

determine the risk (i.e. the expected likelihood and consequences of specific types of attacks on specific assets)

identify ways to reduce those risks

prioritize risk reduction measures based on a strategy

drawbacks.

If risks are improperly assessed and prioritized, time can be wasted in dealing with risk of losses that are not likely to occur. Spending too much time assessing and managing unlikely risks can divert resources that could be used more profitably. Unlikely events do occur but if the risk is unlikely enough to occur it may be better to simply retain the risk and deal with the result if the loss does in fact occur. Qualitative risk assessment is subjective and lacks consistency. The primary justification for a formal risk assessment process is legal and bureaucratic.

Related Questions

Navigate

• Browse (All)
• Browse F
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.