>> Understanding risk.
The learning objectives for
this lesson are to explore risk management,
to define how to measure risk,
and to explain the ways to respond to risk.
Let's get started. Risk management.
The very basic overview of
risk management is identifying,
assessing, and mitigating vulnerabilities and threats.
An easier way to look at this is,
every organization has
something that's important to them,
they need to protect it and they want to
find out what do they have to spend to protect it.
That's basically what we're going to be
talking about through this lesson.
What is important to us?
How much is it going to cost to protect it?
What is the damage if something were to happen to it?
On top of that, every organization has
different types of risks
and they will manage that differently.
There are different things that are important to
one organization that is not important to another.
It's important that we make
sure that we've properly identified what's
important so that we can later on come up with
ways to manage the risk to those valuable assets.
But there are some common frameworks
we can use to help us with this.
The first is the NIST risk management framework.
We can also use the ISO 31,000.
We're going to discuss both of these later in the lesson.
There are five phases to
the overall risk management process.
The first is where we start with the identification
of mission-critical assets or functions.
We go around the company and making sure we've
identified everything that's important.
Now it's critical to make sure we're
asking all the right people.
I've gone into a situation with a company,
where the upper management
let us know that these things were important,
but as we dug through and
we're talking to other departments,
we had another department tell us that this
was important to them only to find out
that the upper management wasn't aware of
just how critical that was to the overall business.
You've got to make sure that you're talking to
everyone to get all of the important parts
of your company's assets or
functions to make sure that you know
what you even need to worry about for risk.
From then, we move down to
the identification of known vulnerabilities.
We have our assets or
our functions, where are they vulnerable?
If we have a building that's in
a typhoon area or a hurricane area,
and we don't have any other way of
restoring operations if something
were to happen, that's a vulnerability.
We need to make sure that we have a way
of planning for these types of vulnerabilities.
But it's critical that we
know where all the vulnerabilities
are before we can even begin addressing a plan for them.
Then we move down to the potential threats.
What are the threats to these assets?
If we're a company that's engaged in
proprietary research that will be valuable to someone,
then you can bet that corporate espionage
or hacker attacks are going to be a problem.
We need to make sure we make plans for those.
Then we move to the analysis of business impacts.
If this thing were to happen,
this thing that we're dreading,
this vulnerability has now been exploited,
how is that going to impact our business?
Once we know all of these things,
we can begin to figure out how to
identify our risk responses.
This is where we decide how
we're going to handle that risk.
How do you go about measuring risk?
Well, first we need to define some terms.
Risk is a measurement of
the impact or the consequence and
the likelihood that a threat
will exploit a vulnerability.
We need to define likelihood.
This is how realistic is the threat to occur.
Are we worried about that a meteoroid is going
to crash into our building? That's not very likely.
But again, if we're doing proprietary research,
that is very valuable
is it likely that a competitor
is going to try to steal that data?
Yes, that's pretty likely.
Then finally, the impact.
If the risk happened, how bad would it be for us?
There are different ways of doing risk analysis.
The first one we're going to discuss is
the quantitative risk analysis.
When you hear quantitative,
you need to think numbers.
For risk, this usually involves money.
We start off with a single loss expectancy.
This is the cost of a single event happening one time.
For example, a server crash.
If we look at the history of
our servers and we average one server crash,
we want to look at the cost of that crash.
What does it cost us when that crash happens?
Then we move to the annual loss expectancy.
This is adding all of
those single-loss events together
over the course of a year.
We hope that our server is not
crashing more than once a year or even once a year,
but if it were to crash multiple times,
then what are those costs together?
Then we have our annual rate of occurrence.
This is how many times in
a year does that single event occur?
There's a formula here for you to be able
to calculate this on a test and you might
see some of these questions where they are giving
you numbers for you to calculate based on this formula.
The ALE equals the SLE times the ARO.
We're trying to calculate what is
the annual loss expectancy,
which is expressed as a cost.
All of these costs added together and that is equal to
the single loss expectancy times
the annual rate of occurrence.
But the SLE can be broken
down further into different parts.
We can define the asset value or the AV.
How much is that asset worth?
The exposure factor or EF is,
what portion as a percentage of that asset would be lost.
An example would be if a hurricane
damaged half of our corporate building,
that will be an exposure factor of 50 percent.
Our SLE can be calculated as SLE equals AV times EF.
Then we also have total cost of ownership or TCO.
This is all costs associated with an asset,
including the cost to operate it
and maintain it over its entire lifetime.
We also have our return on investment or ROI.
This compares the cost of
the item to the benefits it provides.
These next terms are very important and you're likely to
see questions on the test about these.
Mean time to recovery, MTTR.
This measures the amount of
time a device or a service is down,
how long from when it
goes down to when it is back up again?
Then the mean time between failure or
MTBF is the lifespan of a device,
but also the amount of time until a service goes down.
Then with a gap analysis that measures the difference
between the current state and the desired state.
By creating metrics such as ALE, MTTR, MTBF,
and TCO, an organization can
evaluate where they stand and make improvements.
We look at our historical MTTR and our MTBF,
and we decide this isn't
good enough and we need to improve.
By calculating those functions,
we can get numbers that we can use to help move us
towards that goal line by using a gap analysis.
>> There are some issues with quantitative risk analysis.
It's difficult to perform when the value of
an asset or the components cannot be easily determined.
Sometimes it's hard for us to
do, especially with intangibles.
But it does offer an effective way of
describing the assets in an organization,
what the organization actually has,
and then the risks that are associated with those assets.
It can be used to help decision-makers by
providing good information so they
can plan where to place the money,
where they need to spend to lower the risk.
A qualitative risk analysis,
this evaluates through words and not numbers.
Keep in mind quantitative numbers, qualitative words.
It's very subjective and
this is especially so when compared to quantitative.
It works well for the assets that are
intangible such as brand or reputation.
But it requires a lot of input from
other departments such as your marketing,
your sales, and your corporate communications teams.
How do we respond to risk?
The first thing we can do is to avoid it.
This means stop doing whatever is causing the risk.
It doesn't mean ignoring the risk. We can accept it.
This means that if the risk happens,
it's not worth the cost to prevent it.
If it happens, we contain it and
then it's cheaper to contain it than it is to prevent it,
then we can mitigate the risk.
This is the process of lowering
the possibility that the risk will occur.
Usually mitigating controls help
to lower the chance of a risk occurrence.
Then finally, we can transfer the risk.
This is give the risk to a third party.
This is usually done by purchasing insurance.
I've got some good examples
here to help you understand the differences
between the different types of risk responses.
The company has a software application and
the manufacturer has gone out of business.
A lot of vulnerabilities have
been discovered in the software.
To avoid the risk would be to stop using
the software altogether and find a replacement.
To accept the risk is
if the vulnerabilities are exploited,
the damage won't exceed the cost to replace the software.
If we find another software to
replace and the cost is $50,000,
but through our calculations we discover
that if the software
the current one that we're using is
exploited and the cost is only $10,000 to us,
then it doesn't really make sense to
spend $50,000 to move to
a different software platform
because of the cost when we can just accept the risk.
We can mitigate the risk by using
various security products to help harden the application.
We can isolate it to its own air gap network.
Then we can transfer the risk by
purchasing insurance that would cover
the company in the event that we
were breached because of this software.
Let's talk about inherent and residual risk.
Inherent risk is everything in life
carries some level of risk. It is built-in.
Having any publicly accessible servers
creates the potential for an attack.
This is a risk included with offering any service.
Mitigating controls that by lowering the risk.
Residual risk is once we've
done all our mitigating controls,
everything has been applied,
whatever is leftover after that is our residual risk.
Risk appetite is the level of
residual risk that is
acceptable for a given organization.
This is basically you
deciding how much you're willing to put up with.
After you've done enough controls and
you really don't feel like it's
cost-effective to spend any more,
then you're accepting it at that point
you've mitigated it as far
as you can go and now you
have to accept what's left over.
This is your risk appetite.
Different organizations will have higher risk appetites.
You'll see some that fly by the seat of
their pants and don't have quality backups in place.
Obviously, they have a very high risk appetite,
but that has to be decided for each organization.
Risk exceptions.
If a risk cannot be mitigated or
another risk response cannot be applied, for example,
it can't be transferred or
avoided then a risk exception can be used.
However, this should not be done lightly.
When you're doing this you're basically saying,
we can't do anything about it.
We're going to keep performing the risky activity.
But we think we have
a legitimate reason as to why we're doing this.
When you do that, you need to have
a complete description of the risk and then document
the rationale for the decision you
made for the risks exception.
You need signatures from all those making
the decision to be documented with all this together.
This is especially important when it comes
to compliance frameworks like HIPAA.
In the next slide I'll go into an example
where that happened for me.
But when you're basically
saying we're not going to do anything about this risk,
you want to make sure that all the people
that are making that decision have documented
their signature and they're signing off on it because
that's the kind of thing that could
potentially come back and bite you one day.
Instructor side note. I mentioned HIPAA,
but risk is a key part of HIPAA regulations.
From my experience, many practices
either don't have the financial capacity
or the desire to do the things
that are necessary to protect patient data.
They will take the response
of sticking their head in the sand,
which is basically is the same thing as
if you pretend the risk isn't there, it just goes away.
It's surprising how many people
take that attitude about cybersecurity,
because the cybersecurity is
generally not something you can see.
It's not like someone walking up
to you and pointing a gun at you.
Things are happening where attackers are coming in
and stealing data and it may be
months or years before that's ever found.
But because it's not seen,
we don't put importance on it.
I've seen many providers or physicians that
will create wild exceptions
for why they don't want to do something.
They're trying to create documentations or at least
they're trying to go that far, but I can tell you this,
that often the government
agencies that are responsible for investigating this,
the Health and Human Services department,
they don't take kindly this thing
and fines can be very expensive.
But the key to remember is risk doesn't
go away just because we don't like it or
we pretend it's not there. Let's summarize.
We went over risk management and we discussed
the ways we can measure risk with
quantitative or qualitative analysis.
We went over the different risk responses and we
discussed inherent and residual risk
along with risk perceptions.
Let's do some example questions.
Question 1. This is the amount that would be lost
over a year based on the sum total of all SLEs.
Annual loss expectancy or ALE.
Keep in mind some of the questions on the test are
going to ask you exactly like this,
where they're going to use those acronyms
instead of spelling it out.
You need to make sure you know these acronyms
because that's how they could try to
trip you up on some of these questions. Question 2.
When using this type of risk analysis,
words are used to describe the risk and their impacts.
Qualitative risk analysis.
Remember, qualitative uses
words, quantitative uses numbers.
Question 3, how long between when
an asset goes down to when it is restored?
What is the definition for this?
Mean time to recovery or MTTR?
Finally Question 4.
When the cost of a risk occurring is more than the cost
of mitigating it this type of risk responses used.
Acceptance. I hope that gave you a good overview
of risk because we're going to
use these a lot in the next lessons.
If you need to go back and look at it again,
make sure you understand those formulas,
make sure you understand those terms and
those risks responses. I'll see you in the next lesson.