-: Identifying threats.
So we talked about the NIST special publication 800-30
in a brief overview in the last lesson.
But now we're going to go into
it a little bit more in depth.
And here we're going to talk about specifically identifying
threat sources and events.
So we talk about identifying the threats.
There are four major types.
We have adversarial threats, accidental threats,
structural threats, and environmental threats,
such as the hurricane we used in the last lecture.
Now we talk about adversarial threats,
you got to consider their capability, intent and likelihood.
This is the bad guys,
this can be people like trusted insiders,
who are trying to wrong you.
Competitors, who are trying to steal from you.
Suppliers who don't want to live up to
their end of the bargain.
Customers, sometimes they are your threat.
Business partners or even nation states
like advanced persistent threats.
Which you will find over and over again as a common theme,
if you are sitting for the CSA+ exam.
So these are you adversarial threats,
these are people based.
These are people outside your organization,
or in the case of a trusted insider,
inside your organization that are threats.
And you have to understand their
capability, intent and likelihood that they're
going to go and act on those intentions.
Now when we talk about accidental threats,
this happens when somebody makes a mistake.
And when they make that mistake it hurts the security
of your system.
So let's use an example,
you have an system administrator who accidentally
takes the serves offline causing a loss of availability.
This would never happen, right?
System administrators would never be that stupid,
oh wait a minute they are.
In February 2017, this happened to Amazon Web Services.
A technician utilized their standard operating procedure
to take a small number of servers offline,
but when he typed the command in the command prompt,
he didn't type it in correctly.
And so instead taking off two or three servers
like he was supposed to,
he caused a large number of servers to go offline
and almost the entire east coast region,
which was US-EAST-1.
This took down the entire region
and it caused an outage for many, many hours.
Which really hurt a lot of businesses,
including Amazon's reputation,
because how many businesses rely on Amazon?
Oh, yeah, a ton of them.
They all rely on the S3 Services
and the web services provided by Amazon's cloud service.
And east region 1 was one of the earliest regions
that stood up by Amazon,
so it was one of the most densely populated.
So if you want to learn more about this, you can go to
aws.amazon.com/message/41926
as shown on the screen and you can read all about it.
But it's just an example of
what happens when an accidental threat happens.
The guy wasn't malicious, he wasn't an insider threat,
he just made a mistake.
But it caused a lot of downtime for a lot of companies.
Now we talk about structural threats.
This is will occur when equipment, software, or
environmental controls fail.
Things fail, your IT server can fail
due to a hard drive going bad.
Your serve can fail because of overheating
because the air conditioning unit goes out.
The software can fail because there's a bug in it,
or the OS crashes on you.
All of these are structural threats,
it's not a person doing it,
it's not an accident.
It's just something that ends up happening over time.
And so you have to be aware of that.
When you really start focusing on this
from a risk management perspective,
you start thinking about backup systems.
And if the power goes out, do I have generators.
And if the heating goes out,
do I have a secondary heating source?
Those kind of things.
And we can talk about that later on in the course as well.
Now environmental threats.
I talked a little bit about this in the last lesson,
when I used the hurricane example.
But this is anything that can occur when natural
or man-made disasters.
This can be a fire, whether started organically or
somebody starting the fire on you.
Flooding, severe storms,
loss of power from the city power grid,
fiber or telecommunication line being cut,
a tornado going through.
Anything that can happen, earthquakes,
hurricanes, all of those natural disasters they all fall
into this environmental threat category.
And so this is something that you have to consider
when you are doing your disaster recovery plans
and your business continuity plans.
How are you going to overcome the threats
that you can't control such as the environment.
So always remember, the threats come from
both external and internal resources.
They can be your trusted insider
or they can mother nature.
They can be an attacker
or they can be your heating and cooling system
that just fails on you.
But most risk assessors only like to think of their internal
sources first.
Why? Because those are things you can control better.
We aren't just worried about hackers though, right?
We are also thinking about that trusted insider.
And as you design your security controls,
I want you to remember, that you can't just forget
about those disgruntled employees, inept administrators
or the insider threat.
Because those things happen,
but you also need to think about the environment
and external factors.
So think inside, think outside.
All of those things can be threats.
And you've got to consider them when
you're doing your risk assessments.
Now the best practice here is to get copies
of a similar organization's risk assessment if you can
and use it as a base line for your own organization.
If you go to sans.org or if you go to the Nist publications,
they have a lot of example of risk assessments out there
that you can look at
and see what other organizations are doing.
It's okay to copy from others as long as you apply thought
and make sure that it actually applies
to your organization as well.
You also want to conduct assessment checks throughout
the process to ensure that you are staying on track.
Just because this thing was a risk five years ago,
doesn't mean it's a risk today.
Just because it wasn't a risk five years ago,
doesn't mean it's not a risk today.
I'll give you a great example.
There is a system called Quantum Computing
that many countries are working on.
As soon as they figure out how to make a quantum computer,
all of the encryption that we use now, like AES 128,
which is the defacto standard across the board
is going to be able to be cracked
in a mere matter of seconds.
Now this technology doesn't exist yet,
so right now it's not a threat
because it's not really out there.
It's just theoretical.
But give it 5, 10, 15 years,
when someone develops a quantum computer,
now our algorithms that we're using today are useless.
And so everything that we use on the web,
will have to be redone
because AES won't work anymore.
We'll have to get quantum resistant algorithms.
Not that's a little bit above this class,
but it's just and idea to show you that
what's true today is not true 10 years from now.
And what was true 10 years ago is not true today.
Keep that in mind and always revisit that risk assessment
to make sure it's accurate in what you're doing.