Instructor: Types of risk.
In this lesson we're going to talk about
the different types of risk.
These includes external risk, internal risk,
legacy systems, multiparty, intellectual property theft
and software compliance and licensing.
The first one we have is external risk.
This is a type of risk
that is produced by a non-human source
and is beyond human control.
Now, what are some good examples of external risk?
Well, we have things like wildfires.
If there are wildfires burning in your area,
you really can't control that.
You didn't start the fire,
you didn't choose to build your place
after the fire already started.
Instead that fire sprung up
and now it's threatening your organization or hurricanes.
Now hurricanes, again are a natural thing.
They are going to occur and we as humans can't stop them.
Now we can try to mitigate that risk
by putting additional things in place
like building stronger buildings,
having backup power systems and things like that.
But these naturally occurring non man-made risks
are things that we're going to have to deal with.
We might also have things like blackouts.
Now this is an external risk for us
and it's kind of man-made but kind of not.
Now we make the system that generates power
but there are faults in that system
and that could lead to a blackout.
Now, as far as our organization's concerned
we didn't cause the blackout.
Instead we are victims of that blackout.
So we need to identify that
and then work our way through that risk.
And finally hackers.
That's another great example of an external risk.
Now this again is a human source
because it's a person doing it.
But again, it's external to us.
It's outside our organization.
It's beyond our human control to stop them.
If that person wants to attack us, they can attack us.
And so that would be considered an external risk.
Now, when we start talking about internal risk,
internal risk is those risks
that are formed within the organization itself.
They arise during normal operations
and often they're forecastable
meaning you can see them coming
and therefore you can plan around them.
A great example of this would be server crashes.
When you have a system error or a server crash,
that could be something that you saw coming.
For example, I know when I install a router or switch,
it's going to last me 2.5 years or 2.7 years or three years
based on the meantime between failures.
And so identifying that
and knowing that ahead of time means
that I'm going to plan to buy new routers
before they're going to fail on me.
And that way I can mitigate that risk.
Another thing we want to look at is legacy systems.
This is another area of risk and one people often overlook.
Now, when I talk about a legacy system,
this is any old method, technology,
computer system or application program
which includes an outdated computer system
that's still in use.
A great example of this
is if you just look down into your ICS and SCADA networks.
Most of these have outdated things that are still being run.
For example, many of them are still running on Windows XP.
Now, as I'm filming this, I'm already into the 2020s
and yet Windows XP,
which came out all the way back in 2001
is still being talked about, why?
Because Windows XP is still in use today.
Even though its end of life,
even though its end of service,
people still use it in these legacy systems.
The reason is it's too expensive or too hard
to get it out of those networks.
So instead as security analysts
we have to identify these legacy systems
and put mitigations in place so we can keep operating them.
Things like making sure those systems
don't connect to the internet.
Instead we want to make sure
we have additional layers of security.
We want to have firewalls in place.
We want to have segmentation,
other things like that
to minimize the risk of these legacy systems.
Now, the next one we want to talk about is multiparty risk.
Now, what is a multiparty risk?
Well, a multiparty risk is any risk
that's referring to the connection
of multiple systems or organizations
with each of them bringing their own inherent risks.
So let's say you owned a company and I own a company
and we decided we wanted to go into business together.
Well if we did that
and we start connecting our systems together
that is a multiparty risk
because I am now assuming the risk
that you're bringing to the party
and you're assuming the risk that I bring into the party.
Now when we talk about party,
we're just talking about an organization
or another company in this case.
And so if we're multiparty there are two or more parties
that are inside of this agreement
and we each bring risk with us.
The next one we want to talk about
is intellectual property theft.
And this is a big one these days.
A lot of times when hackers are breaking into networks,
it's not because they want to cause you harm
or take down your systems necessarily,
it's because they want to steal what you have.
Now again, that is going to cause you harm
but not harm in the way of taking down your server's harm.
And so when we think about IP theft,
we're really talking about
the risks associated with business assets and property
being stolen from your organization.
And this can cause economic damage,
the loss of a competitive edge
or a slowdown in business growth.
All of these things are risks associated with IP theft.
Now, when you're dealing with IP theft
you really are worried about protecting your stuff.
And so one of the greatest ways to protect
against IP theft
is making sure you have data loss prevention systems.
DLP systems can see when people are trying
to take data out of your organization,
data from your shared drive,
data from your database,
data over email, whatever it is,
if people are trying to steal that data from you,
if you have a protective with data loss prevention
you'll be able to identify it and possibly prevent it.
Remember the ideas are what are important.
When you have these great ideas,
for instance, you might have intellectual property
like the secret formula for Coca-Cola.
That's worth billions and billions of dollars.
So we want to make sure it's protected
if we are Coca-Cola, right?
The same thing happens in your business.
Most of the things that make your business
valuable these days,
is actually the ideas behind the business.
So you have to protect those.
And the last thing we want to talk about
is software compliance and licensing.
Now, when we talk about software compliance and licensing
we have some risks associated with this too.
And I know you might be thinking,
"What kind of risk do I have
with software compliance and licensing?
If I buy a license, there is no risk."
Well, there are risks associated
with a company not being aware
of what software components
are actually being installed on their network.
And that's what software compliance is all about.
So for example, if I'm running an organization
with 10,000 people,
and somebody decides to go to the store
and buy a program and put it on the network,
even though they have the license for it
and they install that thing on the network,
I still am now assuming the risks of that software
because when they installed it
that is now something else
that brings vulnerabilities to the network.
There could be bugs in that software.
There could be things that now need to be updated
and patched because of that software.
And it can cause a lot of problems for you.
So software compliance is a big area of risk.
Now on the other side of this,
we also have the licensing angle.
Now, when you have people who are installing software
a lot of times they're just downloading it off the internet
or bringing it in from home
and they don't have the proper licensing in place.
So let's say you wanted to create some new servers
and you decided to just download
the Windows Server 2016 and install on some systems.
Well, if you don't have the proper licensing for that
and Microsoft finds out,
they might cripple that server
or they might sue you for damages
because you're using their programs without licensing.
And so these again are things that can bring risk
to your organization,
either risk from a cyber perspective
of things being crippled or not working right,
or things from a monetary perspective,
because you can get sued or fined
based on not having the right licensing in place.