>> Hi everybody. By this point,
we've identified our risks,
and assessed our risks,
and have a value for them.
Now, we've got to figure out
the best way to mitigate them.
The most common is risk reduction.
With risk reduction, we're going to lessen
either the probability of
the risk or the impact of the risk.
For example, I can't lessen the probability of rain,
but I can lessen the impact by bringing an umbrella.
I can't lessen the impact of
malware infestation on a system,
but I can lessen the probability of getting
that malware by having anti-malware software installed.
With risk reduction, we're trying
>> to lessen one of those.
>> Again, we're going to keep reducing risk
until we get to a level that's
acceptable to senior management.
If we reduce all the way to zero,
we've actually avoided the risk,
but you can't always do that.
As a general rule,
we look to reduce or transfer risk,
so we can still perform the activities we want to do
rather than not do those things
in order to avoid all risks.
When we talk about putting security controls in place,
we talk about doing things like
implementing policies like,
separation of duties,
or implementing physical controls
like door locks and security guards,
these are risk reduction controls.
If we determine after
research that the risk is too great,
we choose to avoid it.
Another option is risk transference.
Risk transference means we're
going to share in the loss potential.
For example, maybe I'm worried about being able to
provide availability that's necessary
to satisfy my customers,
so I outsource, and I have
my infrastructure migrated to the Cloud,
and take advantage of the uptime
that's promised by Amazon.
If Amazon Web Services doesn't it provide the degree of
resources necessary to get
the high availability that I want,
then there's a reimbursement
based on the service level agreement,
so if there's a loss,
they will always share in the loss with me.
In another example, what if I don't have
the skills to develop a certain type of software,
I outsource to a third-party
software development company.
If they don't meet the requirements, again,
usually the contract calls for
some negotiation if the parties
don't perform according to the requirements.
With risk transference, we're trying to share in
the loss potential so that it doesn't weigh us down.
Now, risk acceptance comes
when either there's nothing we can do about a risk,
or if we determine that it's too
expensive to mitigate a risk.
Sometimes the cost of mitigation
is greater than the potential for loss.
We had an earthquake in the DC area several years ago.
I wondered how often we have earthquakes in
this area, so I did my research,
and found out that in the past 100 years,
we've only had a handful of them,
and they've only been low impact.
Based on this information,
we decided we couldn't justify
the cost of mitigation for this risk,
and we would just accept it.
But we do have an emergency preparedness kit,
and business continuity plan.
When we choose to accept a risk,
it doesn't mean we don't have
some disaster recovery plan
or business continuity plan to deal with it.
It's important that with risk acceptance,
we show our due diligence because
risk acceptance is not the same as ignoring a risk.
Now, when we talk about mitigation strategies,
and risk reduction, we have to
remember the idea of layered defense.
With layered defense, we want technical,
physical, and administrative controls if possible.
Technical controls include, encryption,
firewalls, intrusion detection, and things like that.
Physical controls include,
things like door locks,
gates, lighting, and security guards.
Administrative controls include, policies,
procedures, standards, and guidelines.
Those are the things that come down from
senior leadership as directives and influence security,
so all three of these types of
controls make up a good layered defense.
Now, within each of those categories of controls,
we also have other controls
that serve specific functions.
Within physical, administrative,
>> and technical controls,
>> we can have preventative,
deterrent, corrective, and detective controls.
For detective controls in the physical category,
you have things like, motion detectors,
building alarms, and so forth.
For preventative controls
under the administrative category,
you could have the separation of duties policy.
An example of a deterrent
>> administrative control would be
>> an employee handbook that tells
you what you can and cannot do.
A corrective administrative control
could be a termination procedure.
Each of these major categories of controls have
these additional types of controls
that serve specific functions,
this is all part of the layered defense.
You don't want to rely too
heavily on one type of control or
another because any control can be bypassed.
Quick wrap-up for risk mitigation.
Primarily, responses are to reduce,
transfer or accept risk.
Reducing risk is going to
lessen the probability or impact.
Transference is going to be using
insurance or service level agreements or
contracts with a third party that
is going to help shoulder part of the loss.
Risk acceptance comes when the cost of
the countermeasure is more
expensive than the potential for loss,
or when you just can't mitigate the risk.
When it goes back to reduction of risk, generally,
we mitigate risks,
and reduce risks through controls.
Some controls are proactive,
some controls are reactive,
but we need to make sure we have technical,
physical, and administrative controls in place.
The proactive controls are preventative, and deterrent.
The reactive controls are detective, and corrective.