Instructor: Impact Analysis. 2 2
When we talk about impact analysis, 3 3
this is a really important concept 4 4
as part of our triage function. 5 5
Now, when we talk about triage, 6 6
really what we're focused on 7 7
is how do you look at an event and decide how severe it is, 8 8
and how much priority you need to give it? 9 9
After all, you only have so many resources. 10 10
Now, triage is a concept that originally started 11 11
with the military. 12 12
Military doctors have limited resources 13 13
when they're on the battlefield. 14 14
And so, if they have 10 different injuries come into them 15 15
and they only have enough resources to help three people, 16 16
they need to go through very quickly 17 17
and figure out who is the most severe case? 18 18
Who needs assistance right now, 19 19
and who can wait a couple hours, 20 20
or who can wait a couple of days, or a couple of weeks? 21 21
That's the idea of triage. 22 22
Now, this is really important, 23 23
and hospitals do this all the time. 24 24
If you go to the emergency room right now, 25 25
they're going to look at you when you first check in. 26 26
And if you have a big gaping wound that's gushing blood, 27 27
you're going to get seen right away. 28 28
If you're having a major heart attack, 29 29
they're going to help you right away. 30 30
But if you go in and you have a high fever and a temperature 31 31
and you think you might have the flu, 32 32
well, you might be sitting there for several hours 33 33
until a doctor has time to see you 34 34
because your case is a lower priority 35 35
than the person who needs urgent medical assistance 36 36
because they have a gushing wound 37 37
or they're having a heart attack, 38 38
and that's the idea of triage. 39 39
Now, as we go through and we start thinking about triage, 40 40
we're going to consider different categories. 41 41
For example, is there damage to data integrity? 42 42
Is there unauthorized changes? 43 43
Is there a theft of data or resources? 44 44
Is there disclosure of confidential data? 45 45
Is there going to be an interruption of services 46 46
or will there be system downtime? 47 47
All of these are things that we have to consider 48 48
as we are doing our triage. 49 49
Now, as I went through this list, 50 50
you might've saw that last one with system downtime 51 51
and thought, "That doesn't seem so bad. 52 52
What's the big deal if the system is down 53 53
for a few minutes or a few hours?" 54 54
Well, in reality, system downtime is very expensive 55 55
and costs our companies a lot of money. 56 56
Back in 2019, there was a survey done, 57 57
and they started looking 58 58
at the average cost per hour of downtime. 59 59
As you can see here on the chart, 60 60
the average with about 25% 61 61
was somewhere around 300 to $400,000. 62 62
Now, that is a lot of money for one hour of downtime. 63 63
Some companies though were as high as $5 million or more 64 64
for just one hour of downtime 65 65
with 15% of the respondents saying that. 66 66
Now, if you look down at the up to $10,000, 67 67
zero people said it cost them $10,000 or less 68 68
for one hour of downtime of those larger companies surveyed. 69 69
So, you can see that downtime is a costly factor, 70 70
and as instant responders, we have to keep that in mind 71 71
because if we have a system that is completely down 72 72
and it stops us from being able to take in orders, 73 73
that might be something 74 74
that we need to prioritize resources to quickly 75 75
to get that system back online 76 76
and into a safe configuration. 77 77
Now, triaging categorization 78 78
is going to be done based on one of two things, 79 79
it's either going to be impact based or taxonomy based. 80 80
And these two approaches are different ways 81 81
for us to consider how we want to prioritize things. 82 82
If we're using an impact-based approach, 83 83
this categorization approach is going to focus 84 84
on the severity of an incident such as an emergency, 85 85
significant, moderate, or low priority. 86 86
If we're using a taxonomy-based approach, 87 87
this approach is going to define 88 88
the instant categories at the top level. 89 89
For example, we might call them a worm outbreak, 90 90
or a phishing attempt, or a DDoS, 91 91
or an external host, or account compromise, 92 92
or internal privilege abuse. 93 93
Based on those different categories, 94 94
we would have different procedures and different priorities 95 95
based on the different categories we're using. 96 96
Now, when you're using an impact-based approach, 97 97
you're going to categorize the incident 98 98
based on the scope and the cost, 99 99
and this is usually the preferred way 100 100
of doing this inside the industry. 101 101
If it's a large scope and a very large cost, 102 102
it's going to have a higher priority. 103 103
If it's a smaller scope and it's going to have a smaller cost 104 104
then we might delay our response a little bit 105 105
because we're going to deal 106 106
with other things that are more important. 107 107
Now, in my real-world experience, 108 108
most organizations seem to use the impact-based approach. 109 109
And when they do that, 110 110
they're going to use four main categories 111 111
of impact that you can look at. 112 112
These are the organizational impact, the localized impact, 113 113
the immediate impact, and the total impact. 114 114
Let's take a look at these four areas. 115 115
First, organizational impact. 116 116
Now, this occurs when you have an incident 117 117
that affects mission essential functions, 118 118
and therefore the organization can't operate 119 119
as it's intended to. 120 120
When you're considering an organizational impact, 121 121
this is something that affects a wide range of users 122 122
across your organization. 123 123
For example, if my email server went down, 124 124
that affects pretty much everybody in the organization 125 125
so it has an organizational impact, that's a big deal. 126 126
Then, we go and look at localized impact. 127 127
This is an incident that is limited 128 128
in scope to a single department, a small user group, 129 129
or just a few systems. 130 130
For example, if my customer service manager's computer 131 131
has been hacked, that is one system 132 132
that is localized to her issues. 133 133
And so, while it's a bad thing for us 134 134
and we need to solve it, it's not nearly as bad 135 135
as something as large as all of the email 136 136
across the company is down. 137 137
Now, one thing you have to be careful of, 138 138
don't always assume that a localized impact 139 139
is necessarily less important 140 140
or less costly than an organizational impact. 141 141
Now, the reason why I say this 142 142
is if I have a single computer 143 143
or a single server that's affected, 144 144
that may be a localized impact, 145 145
but it may have less of an impact 146 146
than a larger organizational impact. 147 147
A good example of this might be our payroll system. 148 148
We have one computer that runs our payroll, 149 149
and every Friday we send out paychecks 150 150
for all of our employees. 151 151
Well, if that system was hacked on Thursday, 152 152
that even though it's a localized impact 153 153
and has one function that is being affected, 154 154
one small part of the business, in our case payroll, 155 155
that would be a bigger issue for us 156 156
than the entire email server being down right now 157 157
because we have to get those paychecks out on Friday. 158 158
That's the kind of things you have to think about 159 159
and why you need a thinking human 160 160
being put in place to make these decisions 161 161
because it's not as easy as saying, 162 162
"This affects 10 computers, that affects one computer 163 163
therefore 10 is more than one, that's a bigger issue." 164 164
It's not necessarily that easy. 165 165
It's always more important to think about what functions 166 166
do those machines and systems serve 167 167
inside of the organization or inside that local area? 168 168
The next thing we want to talk about is immediate impact. 169 169
Now, immediate impact is when an incident is measured 170 170
based on the direct cost incurred because of the incident, 171 171
such as downtime, asset damage, penalties, and fees. 172 172
Based on these things, 173 173
you're going to have some kind of dollar value, 174 174
and that allows you to quantitatively assess 175 175
how important this thing is to get fixed 176 176
and how much time you can delay. 177 177
The next one we're going to talk about is total impact. 178 178
Now, a total impact is going to measure that incident 179 179
based on the cost that arise 180 180
both during and following the incident, 181 181
including the damage to the company's reputation. 182 182
So, we take all that immediate impact stuff 183 183
and we add all the long-term stuff as well. 184 184
Let me give you a good example of this. 185 185
Now, a lot of companies have had data breaches, 186 186
and it's bad 187 187
and there's going to be a long-term impact to them, 188 188
but it's not necessarily as severe 189 189
depending on what industry they're in. 190 190
But in my company, we're an online education company, 191 191
and so if we look at all 192 192
the online education companies out there 193 193
and they had a data breach, 194 194
for them it probably wouldn't be that bad. 195 195
They would say they're sorry to their customers, 196 196
they pay some fines, they would do some remediation, 197 197
and they would work on it, and they would move on, 198 198
and there would be no big issue. 199 199
But if my company had a big data breach, 200 200
that would have longer lasting effects 201 201
and have a higher total impact, why? 202 202
Because we teach cybersecurity, 203 203
and if the cybersecurity training company gets hacked, 204 204
that's going to look really bad for us, 205 205
that's going to tarnish our reputation. 206 206
And so, that is going to have longer total impact effects to us 207 207
than a similar company who teaches something 208 208
like how to draw, or how to play piano, 209 209
or something like that. 210 210
And so, you have to think about your industry 211 211
and what that total impact will be, 212 212
and that is going to impact your categorization as well.