-: Risk considerations.
So in this lecture we're gonna talk about
the different considerations we have with risk.
So where does risk exist?
Well it exists right in the center of this Venn diagram.
As you can see there it is where the threat,
the asset, and the vulnerabilities all meet up together.
You have that sweet spot right in the middle
and that's where risk is.
Because if you have an asset that has no threat,
there's no risk there.
If you have an asset that has no vulnerabilities,
there's no risk there.
So it's really important to realize you have
to have a threat and a vulnerability
to make a risk happen on your asset.
When we look at assets, what are those?
Well it's any item that has value to our organization.
This can be information and data like proprietary courses,
your financial statements, the way you do business.
It can be network equipment; things like your servers,
and your routers, and that kind of stuff.
Your servers and your computers.
It can be your software, it can be your personnel,
and it can be your processes.
So all of these things whether they're hard targets
or soft targets like people, they are an asset.
They have threats associated with them,
and there's vulnerabilities associated with them.
When we have a vulnerability and a threat,
you put those together you find the risk.
So we talk about vulnerabilities, what is it?
Well, it's any weakness in the system design,
implementation, software code,
or lack of preventative mechanisms.
That causes this vulnerability to exist.
Often we call them bugs when you
talk about them in software code for instance.
This is an example; you have software bugs,
misconfigured software, misconfigured network devices,
and even improper physical security controls.
For example, if I don't lock the house at night
that's a vulnerability that somebody can walk through
the front door.
Now does it mean someone's going to?
Not necessarily.
There may not be any bad guys in the area
so there's no threat but if I leave it unlocked
that is a vulnerability.
If you have a bug in your software,
does it mean you're gonna get hacked every time?
No.
Somebody has to find that bug first.
That's the threat piece.
So let's talk about threats.
Here's the important thing about vulnerabilities though.
Cyber security professionals like us,
we control vulnerabilities.
Now what does that mean?
Well vulnerabilities are all about internal factors.
Like we said, it can be a software bug right?
That needs to be corrected, and patched,
and that will stop the vulnerability.
Or there may be something that's outside of our control
kind of right?
Like if it's a third party software like Microsoft.
I can't build a patch for Microsoft Windows.
I don't have their source code
but I can put compensating controls in front of that.
Maybe their attacking over port 445,
so I block that in the firewall.
Again as a cybersecurity professional
I'm stopping that vulnerability
by putting other compensating controls in place.
So that's the idea here with vulnerabilities.
You have to remember, this is the internal thing.
It's what our organization can control.
We accept these vulnerabilities as they are
or we put controls in place to compensate for them.
Now when we talk about threats on the other hand,
we're talking about external things.
This is any condition that can cause harm, loss,
damage, or compromise of an asset.
These are things like; natural disasters,
like earthquakes and hurricanes and floods.
This can be a cyber attack where a bad guy
is hacking into your system.
This can be a breach of integrity of your data.
Disclosure of your confidential data, Or even malware.
Now the one that people usually
get stuck here with threats is
they always think it's somebody doing something to you,
like a bad guy, all those four bottom examples
those are things a bad guy's doing to you right?
But the top one isn't, this is Mother Nature.
You can have a fire, a flood,
you can have a hurricane come through.
For instance, right now when I'm recording,
we just went through some massive hurricanes over
the summer in the Caribbean where Puerto Rico got hit,
Key West got hit, Miami got hit,
and many of the other islands in the Eastern Caribbean.
There's a lot of places that don't have power now.
Well if your data farm was down there,
that's a threat to you right?
If a hurricane came through and took out power,
you now have a threat is now a risk that you realized.
So threats are external to your control,
they can be natural, or they can be people based right?
That's the idea here when we talk about threats.
Now if you put your vulnerability
and your threats together,
you gotta consider that cybersecurity
professionals cannot control threats.
They can only mitigate them, right?
These are external to you and so when
we put these things together and we take our threats
and our vulnerabilities together, we come up with risk.
Now what is risk?
Because this whole lecture was on risk considerations.
Well it's the probability of realizing a threat.
So it's the likelihood of it happening, right?
For instance, if you're in Kansas,
which is in the middle of the United States,
you're not usually worried about hurricanes.
It's not a big deal to you because
they don't often get to you.
But if you're in Miami or Puerto Rico
or in the Caribbean, you worry about hurricanes.
Because they happen about once
every year or every two years.
So there's a higher likelihood.
If you have a vulnerability without a threat,
there is no risk at all.
So it's always this balancing act.
Where you say okay we've got this risk,
and the risk is made up of a vulnerability and a threat.
How much vulnerability is there?
How much threat is there?
There's a big threat, then we need to apply more money
to solving the vulnerability.
If there's a little threat, we will apply less controls
and we'll accept more risk because
it's less likely to happen.
This is the whole concept of what
we have to think about when we
talk about risk considerations.
How big of a threat are we willing to accept,
based on our known vulnerabilities?
That's what threat management is all about.
(electronic sound)