-: Risk assessments.
Risk assessments are a process used
inside of risk management to identify how much risk
exists within a given network or system.
These can be conducted in lots of different ways,
including mathematically calculating the risk,
subjectively guessing at the risk, or through the use
of various assessments and analysis techniques
that your team can perform.
Now, before we dive into all the different ways
to determine and calculate risk,
it's probably a good idea for us to start
and define what risk is and where risk exists.
Risk is, at it's core,
the probability that a threat will be realized.
Risk is a continual balancing act
of vulnerability versus threat.
In future lessons, we're going to discuss how we balance
these against each other in order to manage risk well.
Now, as cyber security professionals,
our job is to minimize vulnerabilities.
Vulnerabilities are any weakness
in the design or implementation of a system.
We're given control over vulnerabilities
because they come from internal factors
such as software bugs, misconfigured software,
improperly protected network devices,
lacking physical security or other such issues.
Vulnerabilities are within our control,
or at least within our organizations control.
Whether we choose to address those vulnerabilities, though,
is a decision in risk management.
Conversely, as cyber security professionals,
we can't fully control threats,
but instead we attempt to minimize or mitigate them.
This is because a threat is any condition
that can cause harm, loss, damage or compromise
to our information technology systems.
These threats come from external sources,
such as natural disasters, cyber attackers,
data integrity breaches,
disclosure of our confidential information
and numerous other issues
that arise during our daily operations.
Remember, threats are external to you
and you can't control them, you can only mitigate them.
If somebody wants to attack you, they are the threat;
you can't control whether or not
they're going to attack you, right?
You can only try to minimize your vulnerabilities
so that their attack won't be successful.
Vulnerabilities are completely within your control,
threats are not.
So, where does risk exist inside our networks and systems?
Well, risk exists in the intersection
between threats and vulnerabilities,
and this is a key point you have to understand.
If you have a threat but there's no vulnerability,
then there's no risk.
The same holds true if you have a vulnerability,
but you don't have a threat against it;
there would be no risk there either.
Let's consider the example
of trying to get to work on time in the morning.
Your alarm clock goes off and it's seven am,
so you get out of bed.
You get dressed, you eat your breakfast and now you have to
get from your house over to the office,
but there's a lot of vulnerabilities and threats around you
that could cause a bad outcome.
The bad outcome would be you arrive late for work, right?
So, this is the world of risk management;
it's trying to measure
those vulnerabilities and those threats,
and coming to an area that we can mitigate them
so we can get the outcome we want.
So, let's consider a couple of
these vulnerabilities for a minute.
One might be that you forgot
to put gas in your car the day before,
the vulnerability is a lack of proper preparation.
Another might be that you forgot it was your day
to drop the kids off at school before driving to work,
this is going to take some extra time, right?
There are a lot of possible vulnerabilities
to your plan of getting the work on time,
but you can control all these
because vulnerabilities are internal factors.
Now you could've put gas in the car last night,
or you could have asked your spouse
to drop the kids off at school, that might've helped,
but there's several other threats out there
that are trying to stop you from getting to work on time.
Now these are outside of your control.
What if there was a traffic jam this morning?
That would certainly cause a delay to your commute
and you'd arrive late for work,
thereby realizing that threat.
Another threat could be from a natural disaster,
such as a flood that causes the road to your office
to be destroyed.
Now I know this is being a little melodramatic,
but you're getting the idea, right?
You can't stop a flood; it's an external factor
and a threat to you arriving on time,
if this was going to happen.
Apparently, this guy over here, he didn't get the message
because you can't drive right through a flooded road,
your car's going to get stuck.
Now we have several threats and several vulnerabilities
that we've identified in our examples so far,
but what can we actually do about them?
Well, if we're worried about being late for work,
one thing we could do is wake up earlier.
That way, even if we have the external threat
of a traffic jam or we have a flood
that takes out one of the roads, we could find a detour,
or alternate route, and still get to work on time.
This is what we refer to as risk management;
it's all about finding ways to minimize
the likelihood of a negative outcome from occurring,
and this way we're able to achieve our goal
and get what we really want.
Now, up to this point, we've talked a lot about risk,
but let's talk about some basic strategies
of how we deal with risk.
In every risk management program,
there's essentially only four things that you can do
with risk: you can avoid it, you can transfer it,
you can mitigate it and you can accept it.
The first one is risk avoidance,
this is a strategy that requires
stopping the activity the has the risk
or choosing a less risky alternative.
How does this apply to our IT networks, though?
Well, let's assume that you have a network
that currently has 100 computers,
but 15 of those are still running Windows XP.
If you know anything about end of life
and unsupported software, you know that Windows XP
stopped receiving official support back in 2014.
To avoid the risk of running an unsupported software
like Windows XP, we have two choices:
we can take those computers offline,
meaning we stop the risky activity, or we can upgrade
those computers to something less vulnerable.
Something like Windows 10
that's newer and still has support for the operating system,
thereby choosing a less risky alternative.
Now, the second thing we could do,
is we could transfer the risk.
Risk transfer is a strategy
that passes the risk to a third party,
most commonly, to an insurance company.
A good example of this would be
if your organization is worried about the risk
of your offices being destroyed by floods.
If this is a concern for you,
you could purchase an insurance policy to transfer the risk
of loosing all of your computers and all of your assets
to another third party: the insurance company.
Our third thing we can do, is mitigate.
Risk mitigation is a strategy that seeks
to minimize the risk to an acceptable level,
where the organization can then accept the remaining risk.
For example, if you're running a server
that's been identified to have
five critical vulnerabilities, two high vulnerabilities,
four medium and 17 low vulnerabilities,
you can then decide which ones you're going to deal with first.
Your risk management may have a policy that states
something like, "Any server with critical vulnerabilities
"should be taken offline, but if you can patch
"those five critical vulnerabilities,
"we might be willing to accept the residual risk
"from the highs, the mediums and the lows,
"because this would be within the overall risk policy
"that was set by our organization."
This means our risk wasn't eliminated,
but it was mitigated down and brought lower,
to an acceptable level.
The final thing we can do with risk, is we can accept it.
With risk acceptance,
we're seeking to accept the current level of risk
and the costs that are associated with it,
if that risk was realized.
Generally, this would be a proper strategy
if the asset is a very low cost item,
or the impact to the organization overall
would be rather low.
For example, we may choose to transfer the risk
of a server being damaged,
since it costs like $10,000 or $15,000 to replace one,
but we may simply choose to accept the risk
of a laptop being damaged because it might only cost
a few hundred dollars to replace it, and that's something
that wouldn't affect the overall company.
Now even if we avoid the risk,
transfer the risk, or mitigate the risk,
there may still be some amount of risk left over:
this is known as residual risk.
Residual risk is simply the risk that left over
after you've tried avoiding, transferring
and mitigating the risk.
It's uncommon that there is no residual risk left over
because risk simply exists in every single thing that we do.
Now what is considered an acceptable level of risk
for your organization?
What should you accept?
Well, I can't really answer that for you,
because every organization has it's own risk tolerance
and determines what it's threshold will be
for what they're going to accept.
And this brings us back to the idea
of conducting a risk assessment within your organization.
By conducting a risk assessment,
you can identify the risks that exist,
their likelihood of causing an issue
and how much it's going to cost your organization
if that risk is realized by that threat
exploiting your vulnerabilities.
To conduct a risk assessment,
you only have to use four steps.
First, identify your organization's assets.
Essentially, we want to make a long list of all the servers,
the routers, the desktops and all of our other assets.
Now that we know what we have, we can move to step two
and identify all of our vulnerabilities.
You can do this in many different ways,
including running a vulnerability assessment,
running vulnerability scans,
or even conducting a penetration test.
Our third step is to identify the threats
and the likelihood that that threat will occur.
Remember what I said earlier: "If you don't have a threat
"directed against your vulnerability,
"you really don't have a risk."
Then, we have our fourth step,
which is to identify the monetary impact
of the risk being realized.
In the next two lessons, we're going to focus on
how we actually calculate the level of risk when conducting
qualitative and quantitative risk assessments.
(electronic music)