-: Risk Control and Mitigations.
So when we talk about risk controls and mitigations,
we're really talking about four ways
that we can handle risk.
It's risk acceptance, risk avoidance,
risk mitigation, and risk transference.
Cybersecurity professionals work to minimize risks
to the organization through these risk management
and risk control methods.
And so let's talk about each of these,
and then talk about some controls separately at the end.
So we talk about risk acceptance, what is that?
Well, this is when an organization's
going to accept the risk that's associated
with a system's vulnerabilities and their associated risks.
So if I do risk acceptance,
this is really common when the risk is low
and we don't really wanna spend any money on countermeasures
or deploy any of these countermeasures or controls.
Or if we've already put enough countermeasures in place
that we've brought the risk down.
So for instance,
if you're worried about somebody coming in
through your firewall on port 445,
but you've blocked port 445 on your firewall,
it's now a very low risk of it happening.
We would just accept the risk.
But if we haven't put any controls in place,
and we know there's a lot of attacks on port 445,
we may not wanna accept that, right?
And so risk acceptance is all about,
is it a low enough risk that we're just gonna
let it be where it is.
This doesn't mean there's no risk, right?
There's minimal risk.
So again, we talk about our Kansas
and the hurricane example,
it's a low risk that we're gonna get hit
by a hurricane in Kansas.
It's just like if you're not near a fault line,
you have a very low chance
of an earthquake happening in your house, right?
These are the ideas of things
that we would accept the risk on,
because it's a low probability of something happening,
and it's a low cost that if it does happen.
Now when we talk about risk avoidance on the other hand,
this is when the risk is too high to accept.
The system or a configuration is changed to avoid the risk,
specifically associated with that vulnerability.
I'll give you a great example.
It is 2017 right now, right?
When I'm recording this video, it's October of 2017,
which means it's been four years
since Microsoft has sunsetted Windows XP.
You should not be using Windows XP anymore,
they don't put patches out for it anymore,
but new vulnerabilities are often discovered.
So if you're utilizing Windows XP,
that is way too dangerous.
Instead, we would get rid of Windows XP
and bring in a Windows 7, a Windows 8,
or hopefully a Windows 10 system,
which is a modern operating system.
And that would avoid the risk
of being on an unsupported operating system
with old vulnerabilities being able to attack you, right?
That's the idea here.
We're gonna avoid the risk by just saying,
we're not using XP anymore, we're moving to Windows 10.
Hopefully that makes sense.
It's just gonna get outta the way and avoid it altogether.
The next one, risk mitigation.
Risk mitigation, the main goal is to minimize risk
to an acceptable level.
And we kinda mentioned this a little bit
with risk acceptance, right?
There can be a vulnerability or a threat,
or a vulnerability and a threat,
to give us some sort of risk.
And maybe that's a high risk.
And then we put some things in place, some controls
that bring that risk down to a lower level
where we can now accept it.
That's risk mitigation.
Our goal here is not to eliminate all the risk,
because it's either too costly, or just you can't do it.
But instead, we're gonna mitigate it down
by adding risk controls down into this acceptable level.
I'll give you a perfect example of this.
Everyday you wake up
and you get in the car and you drive to work, right?
Did you accept some risk? Yeah.
You accepted the risk that
you're gonna get into a car accident and die, right?
Kinda morbid, but go with me here.
That's a risk that you're taking by getting in the car.
If you stayed in bed,
you're not gonna get killed by a car
if you're sleeping in your house
on the second floor, for instance.
But if you get in your car and drive to work,
you could get in an accident and die.
That's a risk you're taking.
Now, you mitigate that risk by getting into a safe car
that has airbags, and a seatbelt,
and driving the speed limit,
and taking roads that aren't necessarily as dangerous,
and all of these other things that you do
to mitigate the risk down to a level
that's acceptable to you.
That's risk mitigation.
You're mitigating the risk that hopefully
you're not gonna get into a car accident and die today.
That's the whole idea here with risk mitigation.
Same thing in our servers.
We're gonna patch things,
we're gonna use firewalls,
we're gonna use antivirus,
we're gonna put all these other controls in place
which we'll talk about controls in a few minutes here,
that are gonna help mitigate the risk down
to an acceptable level for us.
Now, risk transference.
This is where I wanna take the risk
and I don't want to accept it,
so I'm gonna just give it to somebody else to accept.
Now, who would wanna take that risk?
Well, insurance companies, right?
And that's a great example.
If the organization can't afford to accept it,
avoid it, or mitigate that risk,
they can transfer it to another business.
And there's businesses, like insurance companies,
who would love to take on that risk for you.
So if I am an organization,
where I realize it's gonna be too costly
to recover from a flood, I buy flood insurance.
And so if my building gets flooded out,
they're gonna come in, clean up the mess,
buy me new servers, and put me back in business.
That's the idea of having flood insurance.
Now, how can they accept that risk, when you can't?
Well, because they're taking that risk
across hundreds of other companies,
and sharing the cost of that
across those hundreds of companies, and making a profit.
So there are things out there that you can transfer risk on.
You can transfer, your car insurance is a great example.
Your homeowners insurance, your renters insurance,
pretty much any insurance is a transfer of risk.
And then there's also other things out there
that you can do transfer of risk as well.
Some of the newer ones that are coming out there
is data breach protection insurance.
Companies can buy insurance,
that if they have a cyber attack,
someone will come in and clean up the mess for them.
And so these are things
that you gotta consider in your business,
and see if it's worth the risk to accept it,
or is it cheaper and better to just transfer that risk
to somebody else?
Now, when we talk about controls,
there's two main categories of controls here,
that can help us mitigate these risks down.
We have technical controls and operational controls.
Technical controls are systems, devices,
software, and settings that are used to enforce
the confidentiality, integrity
and availability requirements.
These are things like we've mentioned before,
firewalls, intrusion detection systems,
intrusion protection systems, antivirus,
malware endpoint protection,
host-based intrusion detection systems,
all of that technical stuff is technical controls.
Now, operational controls are things like
the policies and practices and procedures you use
to increase security.
There are things like conducting penetration tests,
doing vulnerability management,
utilizing standard operating procedures when doing changes.
All of those things are operational controls
to minimize your risk down from threats,
like the accidental threats,
like the guy putting in the wrong number of servers
when he takes them offline.
That's the idea here with risk controls.
It's technical and operational controls.
And there's other types of controls as well,
that we'll talk about later on
when we get to vulnerability management in other courses.
But for now, in risk, we just wanna talk about
these basic controls of technical and operational
to get you started.