1 1 00:00:00,090 --> 00:00:01,410 In this section of the course 2 2 00:00:01,410 --> 00:00:03,120 we're going to cover risk mitigation 3 3 00:00:03,120 --> 00:00:05,850 by focusing on Domain 2, Vulnerability Management 4 4 00:00:05,850 --> 00:00:08,490 and Domain 4, Reporting and Communication, 5 5 00:00:08,490 --> 00:00:12,540 and specifically covering objectives 2.5 and 4.1. 6 6 00:00:12,540 --> 00:00:14,160 Objective 2.5 states, 7 7 00:00:14,160 --> 00:00:15,870 that you must be able to explain the concepts 8 8 00:00:15,870 --> 00:00:19,050 related to vulnerability response, handling, and management. 9 9 00:00:19,050 --> 00:00:20,580 And objective 4.1 states, 10 10 00:00:20,580 --> 00:00:22,140 that you must be able to explain the importance 11 11 00:00:22,140 --> 00:00:25,110 of vulnerability management reporting, and communication. 12 12 00:00:25,110 --> 00:00:27,120 Now, as we move through this section of the course, 13 13 00:00:27,120 --> 00:00:27,953 we're going to start out 14 14 00:00:27,953 --> 00:00:30,240 by outlining the risk identification process 15 15 00:00:30,240 --> 00:00:32,460 that's used in enterprise risk management. 16 16 00:00:32,460 --> 00:00:34,980 Then we're going to be talking about an assessment 17 17 00:00:34,980 --> 00:00:37,560 and how we can conduct one using inventory systems 18 18 00:00:37,560 --> 00:00:39,660 as well as different software tools that we have 19 19 00:00:39,660 --> 00:00:41,220 and in order to be able to conduct a threat 20 20 00:00:41,220 --> 00:00:42,990 and vulnerability assessment. 21 21 00:00:42,990 --> 00:00:45,120 Next, we're going to cover how risk is calculated 22 22 00:00:45,120 --> 00:00:47,940 both qualititatively and qualititatively. 23 23 00:00:47,940 --> 00:00:50,040 Then we're going to move into how we can conduct 24 24 00:00:50,040 --> 00:00:51,630 business impact analysis 25 25 00:00:51,630 --> 00:00:55,200 and perform risk prioritization inside of our enterprises. 26 26 00:00:55,200 --> 00:00:56,033 This is really important 27 27 00:00:56,033 --> 00:00:58,350 because we never have enough time or money 28 28 00:00:58,350 --> 00:00:59,820 to mitigate every single risk 29 29 00:00:59,820 --> 00:01:01,590 within our given systems or networks, 30 30 00:01:01,590 --> 00:01:03,510 but by prioritizing them, 31 31 00:01:03,510 --> 00:01:05,130 we can get the most bang for our buck 32 32 00:01:05,130 --> 00:01:07,290 during our risk mitigation efforts. 33 33 00:01:07,290 --> 00:01:08,730 Next, we're going to be covering 34 34 00:01:08,730 --> 00:01:10,890 how you can communicate the risk we identified 35 35 00:01:10,890 --> 00:01:13,590 to our key decision makers within our organizations. 36 36 00:01:13,590 --> 00:01:16,560 And after that, we're going to discuss training and exercises, 37 37 00:01:16,560 --> 00:01:19,530 things like tabletop exercises, penetration tests, 38 38 00:01:19,530 --> 00:01:21,881 and red team and blue team activities and exercises 39 39 00:01:21,881 --> 00:01:24,210 that help us mitigate organizational risks 40 40 00:01:24,210 --> 00:01:26,520 that could exist within our companies. 41 41 00:01:26,520 --> 00:01:28,260 Finally, we're going to take a short quiz 42 42 00:01:28,260 --> 00:01:30,270 to see what you learned during this section of the course 43 43 00:01:30,270 --> 00:01:32,310 and review each of those quiz questions fully 44 44 00:01:32,310 --> 00:01:33,450 to ensure you can explain why 45 45 00:01:33,450 --> 00:01:34,980 the correct answers were right. 46 46 00:01:34,980 --> 00:01:37,950 So, let's get started talking all about risk mitigations 47 47 00:01:37,950 --> 00:01:39,450 in this section of the course.