-: Risk assessment, so when we talk about risk assessment,
we talk about where does risk exist.
Well, it exists in that sweet spot right between
threats and vulnerabilities,
as we discussed in the last lesson.
But when we talk about a risk assessment,
we have to think about what these are.
And an organization should be conducting these routine
risk assessments to determine how much risk they're at,
they have there in their organization.
So risk assessments are gonna measure your current level
of risk based on the threats, the vulnerabilities,
and the mitigations and controls that you've put in place.
The National Institute of Standards and Technology,
or NIST, publishes a special publication called
the 800-30 series as a foundation for risk assessments.
And you can pull this up, it's a publicly
available document, just go to Google and type in,
"NIST SP 800-30,"
and you'll get this document that's a very large
document that tells you how to do a risk assessment.
So when we look at this, it has this beautiful chart
inside of there, it talks about the first step
is to prepare for the assessment.
Then you get into step two,
which is conducting the assessment, and you'll see there
that there's several steps to it.
Identifying the threat sources, we talked about identifying
your threats, right, identifying your vulnerabilities
and predisposed conditions, which is what do you look like,
what vulnerabilities do you have.
So you see, threats and vulnerabilities.
And then we're gonna determine the probability that
it's gonna happen, that's that likelihood,
that's really risk is what we're talking about there.
And then we take it a step further and we say,
"Okay, if we have a bad thing, like a natural disaster,
"like a hurricane, and it goes against our server farm,
"that's our vulnerability that's sitting in Puerto Rico,
"well, the likelihood of that happening is maybe
"once every five years they get a major storm.
"That's a pretty high risk."
And then we look at what's the impact of it.
Well, if that server farm goes down,
we're gonna lose X amount of dollars per day, right.
And determining based on that, we'll determine if we have
a low, medium, or high risk.
I would say if your threat is a hurricane,
and it's talking about an island nation in the Caribbean,
you probably have a pretty high risk.
Again, going back to last lesson, if I had a hurricane
against Kansas, that's a very low risk because it's
a landlocked area very far up inside the United States.
So that's the idea here.
Now, once you do that, you move into step three,
which is communicating the results.
So we say, "Okay, I've got all this risk,
"and I've identified them as low, medium, or high,
"or critical, and I take them to management
"and I communicate that with them, and then they're gonna
"determine what we're gonna do.
"Are we going to accept the risk,
"or are we gonna put controls in place to lower that risk?"
And we're gonna continue by step four,
maintaining that assessment, and we go back and look at it.
Well, we put this new server in and this new software,
does that introduce new risk?
Does it fix old risk?
All of those things are gonna be gone
over and over and over again, and that's the idea here
in the NIST Special Publication 800-30.
So that's the idea of a risk assessment.
Very quick example, just to give you an idea
of what we're gonna do.
So again, in summary, what are we gonna do?
Four major steps, we're gonna prepare for the assessment,
we're gonna conduct the assessment,
we're gonna communicate our results,
and we're gonna maintain the assessment.
You can remember those four steps and the idea that
we're measuring threats versus vulnerabilities
to figure out the impact in risk,
that's all a risk assessment is.
(light music)