>> Hi everybody. We're starting out with one of
the most important topics and information security,
and that's risk management.
Of course, we'll look at some security basics as well.
What we want to do from
the very beginning is spring
security in the realm of risk.
Because that's what allows us to make
good business decisions that support
the security function while also
making sure that we delivered value to the business.
We're going to start off with the risk management
and security overview,
and then we're going to focus
>> a bit more closely on risk
>> and look at the four phases of
the risk management life cycle.
Risk identification, risk assessment,
risk communication, and risk monitoring.
From there, we're going to see
>> how looking at risk allows
>> us to identify information security priorities.
We'll also discuss audits,
vulnerability assessments, and penetration tests.
When we talk about information security,
a lot of things come to mind.
But our focus here is on our need to
protect organizational assets,
commensurate with the value of the assets,
and then threats and vulnerabilities.
That last part is important,
commensurate with the value of
the assets and the threats and vulnerabilities.
If you've ever heard the statement,
you can never have too much security,
that's actually not true.
You can definitely have too much security.
It needs to be appropriate for
the asset you are protecting
and be reduced to a level that is
acceptable to senior leadership.
For example, you probably wouldn't
have a retina scan system to protect your house.
Is that it's too expensive and not
commensurate with the assets that you need to protect.
But if you were protecting
a top secret government information,
a retina scan might make sense.
Assets are something we value,
it could be tangible like a big screen TV,
or intangible, like a company's reputation.
You always start with your assets,
figure out what they are and what they're worth,
then you look at what threats exist.
Threats are those elements that would
pose harm to your assets.
Now, a threat is only going to be
successful if there's a weakness,
and another word for weakness is vulnerability.
When we talk about risk,
we think in terms of those
>> three things coming together;
>> asset, threat and vulnerability.
When I'm looking to implement a security control,
which is something that mitigates risk,
I need to think about the value
of the assets I'm protecting,
as well as the threats and vulnerabilities.
Otherwise, I may spend too much on
security or I may not spend enough.
The question is how much security is enough?
The answer is just enough based on risk management.
Now often, when you implement a
>> control to mitigate risk,
>> it doesn't eliminate all risk,
and the amount of risk that is
left over is called residual risk.
As an example, let's say
that I'm worried about malicious activity
from outside my network impacting internal resources,
so I might configure a firewall.
That's going to go a long way to keep
malicious actors off my internal network.
But that doesn't eliminate
any conceivable possibility of
something affecting my internal network.
But what it does do is bring down the total risk to
a much smaller amount and
>> what is left over is residual.
>> Then I look at residual amount
and I determine whether it's acceptable or not.
Sometimes the amount of risk that is
left over is acceptable,
so what our job is with risk management is to
reduce the risk to a degree that
is acceptable to senior management.
That's what risk management and
information security is all about.
Then of course, you need to monitor and maintain
that risk to make sure it
continues to stay at that acceptable level.