>> The risk life cycle.
The learning objectives for this lesson
are to explore risk frameworks,
to identify the parts of the risk
>> management life cycle,
>> and to define risk tracking methods.
Let's get started. Risk frameworks are
a guide that help you
implement risk-management in your own organization,
but they come from an authoritative reference point.
These are created by organizations that have a lot of
experience with this and have created best practices.
They're a good starting point for you
to implement in your own organization.
The NIST cybersecurity framework
was created by NIST and it's
very popular framework that's
been adopted by the United States government.
It has five core functions.
These are to identify,
protect, detect, respond, and recover.
The risk management steps of this
are to: prioritize and scope,
orient, create a current profile, risk assessment,
and to create a target profile, then to determine,
analyze, and prioritize your gaps
and then finally to implement your action plan.
NIST also has their own risk management framework.
This is a requirement for US federal agencies to use.
The risk management framework steps
are to prepare, categorize,
select controls, implement, assess,
authorize and then monitor.
The International Organization
for Standardization or ISO,
has their own risk management framework
and this is known as ISO 31,000.
Is a comprehensive framework,
but it also considers risks that's outside of cyber.
For example, financial and legal.
For the test, you want to make sure that you
understand what each of these frameworks are.
You don't necessarily need to know
all the details and what all the steps mean,
but just make sure that you
understand the difference between
the risk management framework and the ISO 31,000.
You want to make sure that you can differentiate
those for the test.
The Control Objectives for
Information and Related Technologies or COBIT,
it frames risk according to
the leadership of a business organization.
If you see a question on the test that is
related to the leadership of an organization,
you want to think COBIT.
It's five components are
framework, process descriptions,
control objectives,
management guidelines and maturity models.
The Committee of Sponsoring Organizations of
the Treadway Commission or COSO,
has developed their own framework.
This is a group of five private
sector organizations that developed
the framework and it's known as
the Enterprise Risk Management Integrated Framework.
It defines risk management in
the approach of strategic leadership.
Typically, you're going to see questions that are
related just to the acronym COSO.
Let's talk about the risk management life cycle.
It begins with identify.
We have to know what our risks are,
what are assets are,
what our vulnerabilities are.
We begin by identifying all of those. Then we assess.
Now that we know what all of those are,
how do we go about
identifying the ones that
are the most likely to be a threat to us,
the ones that are most likely to be exploited,
and what can we end up doing.
From there, we implement our controls.
How can we protect those?
How can we mitigate the risk?
How can we transfer the risk if that's a possibility?
How do we go about ensuring that,
that risk is no longer as risky or a risk at all to us.
Then finally we review.
Whatever we put in place,
we want to make sure that it's still working.
Perhaps, a technology
that we installed was working when we installed it,
but it's no longer working now.
The thread has migrated into another form and we
have to make sure that the controls we
have in place address that as well.
As you can see, this is a continual cycle.
You're going to constantly go from identify,
to assess, to control and review,
and then back to identify again.
Because new vulnerabilities or risks
or exposures are always coming up.
We want to make sure that we keep going through
this process because it is a never-ending process.
Let's now talk about control categories.
There are three control categories.
These are the people, technology, and processes,
but they all work together
and they're inseparable from each other.
People are the most common area of
concern because they're the ones most
likely to buy these pass controls.
Processes are where we need to make sure everything
is documented and when you're thinking about processes,
think of it in terms as
a step-by-step instruction manual on
how to do things in your organization.
Then technology by itself
is not going to do anything for us.
We need to make sure that we have
processes in place that help our technology to
solve the problems and to
help people to work more efficiently
without causing an undue burden on them.
But at the same time, we want to make sure that it also
limits those same people from causing problems for us.
You can see how all three of these work together.
We can't make any changes in one
without it impacting one or the other two.
Control objectives.
The five functions of the NIST
cybersecurity framework core are,
first identify, protect,
detect, respond and recover.
You can see that we're following a standard pattern
across all of these different types of frameworks.
They all follow the same basic model.
We first have to identify.
We have to know what we need to
protect and what our risks are.
Then we have to implement
a protection mechanism therefore.
Then we have to build to detect threats that are coming
in and make sure that we're able to respond to that.
Then finally, we want to be able to recover.
Risk tracking methods.
When we're implementing all of these,
we need to know if they're working for us.
This is where these different tracking methods come in.
The first one is the Key Performance Indicator or KPI.
It measures the performances of
a program compared to the desired goals.
It will determine the effectiveness
based on current measurements against the goals.
With this, we're going to see where we are,
see what our measurements are,
and look at it as compared to where we want to be.
Is this control or is this system working well for us?
If not, we need to make some changes.
Key risk indicator or KRI,
by analyzing our key performance indicators or KPIs,
new risks may appear in the trends.
These risks should be
analyzed and then addressed proactively.
Like I mentioned before, it's an ongoing cycle.
Just because we put something in place today,
doesn't mean it's going to protect
us from everything tomorrow,
we have to keep analyzing and make sure that we're always
looking out for the new risks
that we are going to be exposed to.
Then we also have the risk register.
This was first created in ISO 27,001.
Visualization of identified risks
and their corresponding controls.
It is the most recognized output of
a risk management program and it is a working document.
Again, this is a constantly evolving process.
You have one risk today that
you have put a control into mitigate that risk,
but maybe tomorrow that's no
longer a risk and something new has come along.
>> This is an example of a risk register.
We have a website being hacked is a risk.
The threat would be a hacktivist and the impact would
be high because it would take
our corporate website offline.
The likelihood is medium.
Maybe that's because of some of
the controls we already have in place for it.
Then we have a plan in place if that were
to become a real event for us,
what we would do, and then what our risk level is.
As you can see, you can put all of
the risks that you've
identified here and then the level of threat,
the level of impact,
likelihood, and then make a plan for it.
This helps you to visualize everything on one document.
But keep in mind again, like I said,
this is ever evolving document.
It's always going to be moving forward based on
the new risks that your organization is exposed to.
Risk appetite and risk tolerance.
Risk appetite, this is often guided by
regulations that a organization is subjected to.
This is defined as what
an organization will do to address risk.
How necessary is it to address a given risk?
Many organizations will have
a low-risk tolerance because
of the regulations that they're under,
they can't allow for anything to happen.
Whereas new organizations such as
startup companies may have a high-risk appetite
because they don't have the resources in place
necessarily to put all of the controls in place.
Every organization's risk appetite is a little different.
You need to make sure that you understand what
your organization's risk appetite is
before you go about making
plans for implementing controls.
Then risk tolerance is the thresholds that
separate the different levels
of risk for an organization.
It may be defined by money, impact,
scope, compliance, privacy, or time.
The level of risk that is
acceptable to achieve a certain goal.
Risk caused by people.
People will always be the hardest part
to manage in any cybersecurity program.
People are unpredictable.
People will make mistakes because of stress,
or maybe they were tricked,
for example, a phishing email.
But sometimes they even have malicious intent.
But because of all of this,
people are going to be our biggest concern.
Technology isn't the only solution
to help us with this unique problem.
We're going to discuss some of those
other ways that we can do
things that don't necessarily
relate to technology specifically.
We can use employment policies,
for example, a separation of duties.
This is a checks and balance.
If someone is supposed to do a type of work,
they should not be the ones to audit or monitor it.
In addition, all key roles are not
given to one person in case they are compromised.
If the person who is writing the checks is
not also the one that is balancing the checkbook.
We want to make sure that it's very
easy to discover fraud
when you have separation of duties.
If one person is doing everything then it's very easy for
that person to cover up anything
that they might be doing.
We also want to use job rotation.
No one should stay in the same role
for long periods of time.
This helps to ensure that the organization
can't be controlled by a single individual,
but it also helps prevent abuse of power.
Another way of looking at this in
a positive way is that you have
cross training so that you have
multiple people that can fulfill the same role.
If someone went on vacation or
someone was out sick for an extended period of time,
you have that to help you.
But for our purposes with risk,
we want to make sure that we don't
have one person that holds all the keys to the kingdom.
We can also use mandatory vacations.
This is forcing an employee to take
their vacation time and during
that time another employee will handle their role.
This would allow for discrepancies to
be found if someone were doctoring
the books or some other type of
fraudulent transaction was occurring
and it stopped while they were on vacation,
that would help us to be able to more
quickly identify that to be an issue.
Least privilege is making sure that we're only granting
the necessary level of
access to perform a given job role.
We don't want to have authorization creep
where additional levels of authorization
were given to someone and that
overtime expanded more and more and we
never went back and remove those after
a particular task was completed.
They no longer need that level of access.
This is really hard to manage.
You have to make sure that you're
auditing your users with
what levels of privilege they have on
a regular basis that if
they needed it and they no longer
do, it needs to be removed.
This is critical to help ensure
that people aren't getting into
areas that they're not supposed to be in.
We also need to make sure we have employment
and termination procedures,
onboarding and termination procedures that will outline
all of the steps that are necessary
for each stage to be completed.
When someone new comes on,
there should be a checklist that you follow to say,
these are the things that need to be performed.
We need to issue a key to the building.
We need to give them an alarm code.
We need to give them a key access card.
We need to create
a user account and give them
these privileges, that type of thing.
Then the opposite is true when they're terminated.
We need to make sure that we collect the key,
change the alarm code, whatever needs to be done.
But so many of those things fall through the cracks.
A really common one is when a user
is terminated and no one turned off their VPN access.
That is very common.
You can see that a lot with
angry employees or former employees that had been fired,
but their VPN access was
still on and they were able to get into
the system and either wreak havoc or steal data.
We can use awareness training.
This is helping employees to understand security risks.
Employees aren't thinking about security
like cybersecurity professionals are.
We need to help them to understand
what their responsibilities and their roles are.
But the key point here is that
training needs to be tailored to the audiences.
Because, for example, management doesn't need to
receive the same type of training as technical staff.
When you create your awareness training system,
make sure that you're targeting it
towards the right content, towards the right group.
We also have auditing requirements.
Auditing is a necessary part of any security program.
It's time-consuming and it's not a lot of fun.
But we need to make sure that we're auditing
account activities such as the creation, deletion,
and modification of user accounts,
access rights, as I mentioned before, and account usage.
The frequency of audits will be determined by policies,
but also in trends.
The key is that auditing is looking for
abnormal behavior or activity.
Let's summarize. We discussed
risk frameworks and we went
over the risk management life cycle.
We went over to control categories and
risk tracking methods and then we
discussed the risk that is caused by people.
Let's do some example questions.
Question 1. This would
be used to force an employee to take
a leave of absence during which time
another person will handle their work roles.
This can spot activity that the employee was hiding.
Mandatory vacation. Question 2.
This tool outlines the risks and organization may
face where the threat could come from,
the risk level, and the actions
to be taken if it occurs.
Risk register. Question 3.
This framework is required for
US federal agencies to manage cybersecurity risks.
It has seven steps.
NIST risk management framework.
Finally, Question 4.
This would be used to combat authorization creep.
Least privilege. I hope
this lesson was helpful for you,
and I'll see you in the next one.