In this lesson,
we're going to talk about risk management.
In every network, we have threats and vulnerabilities,
and when these two are combined, this is
where risk is going to exist within our networks.
Let's consider a simple example you probably deal
with every day in your own life.
When you're ready to go to bed at night,
do you lock the doors to your house?
Well, this little question,
each and every evening, is going to be answered
by your actions after you conduct a quick risk assessment
as part of your ability to manage the risk to your home,
its contents and your family.
First, you consider the threats.
There might be a burglar who wants to get inside
and steal all your valuables,
or maybe you live in an area that's pretty windy,
and this could result in the door being pushed open at night
and the elements like the wind
and the rain getting inside and ruining all your stuff.
Next, you're going to consider the vulnerabilities
that could exist.
In this case, maybe you have a front door
and a back door and a garage door that leads into your home.
Now, each of these represents a vulnerability if you don't
lock it before you go to bed at night.
Now, should you lock these doors?
Well, that depends on your assessment of the situation.
If I was worried about a burglar,
I probably would lock all three of these doors.
But on the other hand, if I'm trying to mitigate the threat
of wind opening my door, I may only need
to lock the front door and the back door
because the door leading into my garage is already protected
from the wind because I have a large garage door there
as well that's already in the closed position,
and it blocks the wind from entering my home.
Now, I know this is a pretty silly example,
but at its core, this is the basics of risk management.
Risk management is the identification, evaluation,
and prioritization of risks, followed by the allocation
of resources to minimize, monitor
and control the probability
or impact of a vulnerability being exploited by a threat.
In order to conduct risk management,
we often conduct risk assessments.
Now, a risk assessment is a process
to identify potential hazards
and analyze what could happen if a hazard occurs.
Simply put, a risk assessment determines possible incidents,
their likelihood and consequences,
and your organization's tolerance for such events occurring.
To conduct risk management within our organizations,
we usually use two different types of risk assessments.
These are known as security risk assessments
and business risk assessments.
Now, a security risk assessment is used to identify, assess,
and implement key security controls within an application
system or network.
Security risk assessments may be conducted
as a threat assessment, a vulnerability assessment,
a penetration test, or a posture assessment.
Now in a threat assessment,
we're going to focus on the identification
of the different threats that may wish to attack
or cause harm to our systems or networks.
A common tool that we use to do this is known
as the Mitre ATT&CK framework.
Now, the Mitre ATT&CK framework is a globally accessible
knowledge base of adversary tactics
and techniques, based on real world
observations from the field
and lets an administrator or analyst walk
through the typical methodologies that are used
by different threats to harm your networks
and identify where you should focus your resources
to better protect yourself.
Now, a vulnerability assessment on the other hand,
is focused on identifying, quantifying,
and prioritizing the risks
and vulnerabilities in a system or network.
To conduct a vulnerability assessment,
a technician will normally use a vulnerability scanner,
something like Nessus or QualysGuard
or OpenVAS to enumerate each system or machine
on that network and identify the versions of every piece
of hardware and software that's being used,
and then it can create a summarized report
of which systems have open vulnerabilities
and which ones need to be remediated.
Now, the big difference between these two is whether you're
looking at the target network through the eyes
of the attacker or the eyes of a defender.
Remember, a threat is controlled
by the attacker or an event.
They get to determine how and when it could be occurring.
Now, a vulnerability on the other hand,
is usually going to be within your control.
After all, if you have an unpatched network router,
that's a vulnerability,
but you could remove that vulnerability
by patching the system or replacing that router.
Sure, there are some vulnerabilities
you can't remove completely, like the vulnerability
of the network losing power,
but you can add additional controls to help mitigate it
and reduce that risk.
You can do this by adding battery backups
or diesel generators, for example, to provide secondary
and tertiary backup power to your systems and your networks.
In some security risk assessments,
they'll also combine a threat assessment
and a vulnerability assessment into one single threat
and vulnerability assessment
to provide a more holistic perspective
of your network and its security.
The third kind of security risk assessment we have is
a penetration test.
Now, a penetration test is an attempt
to evaluate the security of an IT infrastructure
by safely trying to explain vulnerabilities within the
system or networks.
Penetration tests are also useful in validating the
effectiveness of your defensive mechanisms as well
as the adherence of your security
policies by your end users.
Now, a penetration test is a technical assessment,
where ethical hackers within your organization have
permission to attempt to break into the network
to validate your security controls
and identify where improvements could be made.
Now, the fourth type of security risk assessment we have is
known as a posture assessment.
A posture assessment is used
to assess your organization's attack surface in order
for you to better understand your cyber risk posture
and exposure to threats that are caused by misconfigurations
and patching delays.
A posture assessment will often include four main steps.
First, define your mission-critical components.
Second, identify strengths, weaknesses, and security issues.
Third, strengthen your position.
And fourth, stay in control.
By conducting a posture assessment,
you will ensure you're always up to date on the status
of your system security
and to ensure you always
understand the health of your systems.
Often, you'll combine this posture assessment with a threat
and vulnerability assessment as well.
Now, in addition to conducting security risk assessments,
your organization may also conduct
business risk assessments.
Now, a business risk assessment is the process
of identifying, understanding
and evaluating potential hazards in the workplace
concerning the day-to-day running of your company.
Now, there are two main types of business risk assessments,
process assessments, and vendor assessments.
A process assessment is the discipline examination
of the processes used by your organization against a set
of criteria to determine the capability of these processes
to perform within the quality, cost and schedule goals.
Basically, that's a lot of words to say
this method is used to determine if you're doing the right
things and if you're doing those things the correct way.
Now, maybe you have a process in your organization
for the creation of a new user account on the network.
This process may have eight steps
to creating the account, and then the
entire process should take less than one work day
to complete from the time the submitted request is received.
This is the basis of your process.
So during your process assessment,
the auditor might watch you perform this process
and they'll see all the steps you do
to make sure they make sense
and to make sure you're doing them properly
and within the proper timeframes
to ensure it's all being done
within the requirements you've set.
Now, after the assessment,
there may be some recommendations on
how you could speed up the process or take some steps out
or refine it to get a better, higher level
of quality within some sort of the process.
All these are things that can come out
of a process assessment.
Now, the second type of business risk assessment is
known as a vendor assessment.
A vendor assessment is defined as the assessment
or evaluation of a prospective vendor
to determine if they can effectively meet the obligations
and the needs of the business regarding the product.
Now, by conducting a vendor assessment,
we can assess the suppliers
and contractors' ability to ensure they're implementing
and maintaining the appropriate security controls.
This is also used to mitigate the threat
of a supply chain vulnerability.
For example, a few years ago, there was a big issue
with counterfeit Cisco devices.
These were routers and switches
that are being sold to other businesses.
Now, these devices were being sold by third party vendors,
not Cisco directly,
and these vendors themself didn't even realize
that they were selling counterfeit devices.
The problem is that it introduced new vulnerabilities into
the business networks, all over the world,
because these counterfeit Cisco devices had malware
installed in their firmware,
effectively giving the threat actors a backdoor into various
business networks all over the globe.
For reasons such as this,
it is really important to vet your vendors
and your suppliers to make sure they understand
what their supply chain looks like,
and this way you can minimize your risk
of supply chain issues.
Also, you want to make sure that they won't fail
to deliver on their contractual obligations,
and doing a vendor assessment can help with that too.