A threat is a potential source of danger that could exploit a vulnerability, flaw or misconfiguration
within our system and causes adverse consequences within our organizations, assets, operations or
objectives.
Within the slide here, you can see likelihood versus impact, where likelihood is how often or what
is the chance of this occurring.
We could have an impact that is high, i.e. our server crashes or impact that is very low, where,
you know, we get a paper cut when we're looking at likelihood versus impact, we need to take into
account that I could have a very high impact with a very low likelihood.
And while that is still precarious within our system, we may only rate that as a medium flaw or a medium
risk within our system.
Risk versus likelihood or impact versus likelihood is the model that most organizations use to understand
what level of risk I'm willing to undertake based on my system or in my organization, we often do a
risk analysis.
A risk analysis usually encompasses different steps, as you can see here.
But I really want to talk about risk analysis on an everyday basis.
Believe it or not, you as a human being, you do a risk analysis every single day, whether you believe
it or not.
When you get out of bed first thing in the morning, you unconsciously make a risk assessment.
You realize that, hey, I need to pull the blankets out from underneath me.
Very low impact.
If something were to go wrong, very low likelihood that something could go wrong leads to a very low
risk.
When I step out of bed and it's on my own master bedroom, I have a very low likelihood of stepping
on something that I shouldn't.
I also have a very low impact that if I were to step on something, that it could hurt me.
Now let's go back into my kids bedroom.
They have Legos all over the place.
There are literally Barbie dolls lining the floor waiting to jump out of me and kill my feet.
If I were to accidentally fall asleep in my son or daughter's bed at night because we had company come
over, or something else, then the likelihood of me stepping on something is incredibly high.
The impact is probably medium, although I would consider Legos to be in that critical nature.
Personal abuse aside.
So when we look at the risk matrix for likelihood versus impact, we can see that risk analysis taking
place.
We also do a risk analysis every day when we jump in our car.
Do I plug in my seatbelt?
Do I decide not to wear my seatbelt because I'm only going five miles away?
While there is a legal requirement for me to put my seatbelt on or be ticketed, the fact is, is that
I still have the option to do it or not to do it, and I can provide that mitigating circumstance against
my risk analysis.
When I decide to drive my car.
If I drive my car to work every morning, I presumptively do a very quick risk analysis before I get
behind the wheel.
Have I been drinking?
No I haven't.
Did I put my seatbelt on?
That's going to mitigate any causes that could be on the road for potential impact against my health.
If I get into a car accident without my seatbelt on, chances of or likelihood of having a major accident
or critical system failure within my internal organs is probably high.
That would raise the impact of me having a hurtful incident if I put my seatbelt on.
The likelihood of having a hurtful incident on my internal organs goes slightly down.
So I've done compensating control or mitigating factor against that perceived threat.
And you unconsciously do this every single day if it's been raining outside.
I make a conscious effort.
Do I want to be driving in this thunderstorm?
Do I want to go out and go get that gallon of milk, or can it wait till tomorrow?
We do risk analysis every single day and believe it or not, so do you.
Whether you realize it or not, within each of our minds we have something called risk tolerance.
And an organization is no different.
If we take my driving the car, uh, scenario back into risk tolerance, you have to decide if it's
storming outside and I don't have my seatbelt working properly.
Am I willing to accept that level of risk as I go outside and drive my vehicle?
Chances are yes or no, depending on how slick the roads are.
What if it's a tornado?
Probably not a good idea, but still, there's a risk tolerance level.
There's still people that go out there and chase tornadoes.
Their risk tolerance is probably higher than mine.
What is my past training done?
Has that eliminated the impact or likelihood of something occurring?
What is the tolerance level that I'm willing to accept for my personal well-being as I'm going forward?
Enterprises do the same thing.
They could take a risk and decide, am I willing to accept this risk with your own IT department?
Am I willing to take the risk of having telnet operational within my internal systems?
It's unsecure, unencrypted, and open to the public.
If I do telnet, there is a risk that something bad could occur within my systems.
By leaving that port open, my risk tolerance level needs to accommodate that level of risk that I'm
willing to accept.
We also have what's called risk response.
Within risk response, we naturally go through this order.
Am I going to accept the risk?
Let's take my car example once again.
If I decide to go out in the rain wearing a seat belt to mitigate the risk with the training.
I have to go get a gallon of milk in the middle of a thunderstorm with wet roads, and I decide to go
to the store anyway.
I'm accepting that risk.
I'm accepting the risk that something bad could happen to me if I decide, you know what?
It's not worth the risk.
I'm going to go back inside.
And you know what?
The kids don't need milk for their cereal, or they can have something else.
I'm avoiding the risk.
I am not taking the car to the store.
That's risk avoidance.
I could also transfer the risk, not so much in our thunderstorm example, but let's say that every
day I get in my vehicle, there is still a risk that an accident could occur.
If that accident occurs and I don't have car insurance, then I get into the accident.
I'm liable for the damages.
I'm liable if something happens to my car and I hit a tree.
I have to pay that fee.
That is a risk that I have.
I accepted, but if I have insurance, I've transferred that risk to the insurance company.
Yes, there's a deductible, but the insurance companies that come in and pick up that cost, that's
known as risk transference and an organization, we could do the same thing.
We can take out cyber security or incident insurance, we can say, you know what, there is a likelihood
that malware could take place and it could wipe my servers.
I'm going to purchase risk transference or risk insurance against this happening.
I've transferred the risk off of my organization onto the insurance company and paid them to do so.
I can also do risk mitigation, which we believe I've already talked about.
Right.
We tug in our seatbelt.
We're providing a mitigation of risk.
I turn my headlights on because it's storming outside.
I've mitigated a little bit of risk by allowing other drivers to see that, hey, I'm here, my headlights
are on.
Let's not get into a head on collision.
This is risk mitigation.
In our enterprise environment, we could do the same thing.
We could go through and say, you know what, let's turn off that telnet port.
We don't want to deal with that.
We only want to have SSH.
We do network hardening to mitigate as much of the risk as possible.
We're going to put antivirus systems on our on our client computers.
That's risk mitigation.
Could the malware still get in.
Yes it could.
We're still accepting that risk.
But we're mitigating it by providing some antivirus software within our client machines.