Lecturer: Risk identification process. 2 2
In this lesson, we are going to talk about risk 3 3
and how you can identify it. 4 4
Now, one of the big things we're going to talk about with risk 5 5
is the idea of enterprise risk management. 6 6
Now, enterprise risk management is the comprehensive process 7 7
of evaluating, measuring and mitigating the many 8 8
different risks that pervade an organization. 9 9
This is important, because in all of our organizations, 10 10
we face risk. 11 11
There are risk to our systems, there's risk from attackers 12 12
and there's risk from the environment 13 13
and we're going to talk about all of this, 14 14
throughout our risk management journey. 15 15
Now, what is risk management 16 16
and why is it adopted by organizations? 17 17
Well, quite simply put, we have to manage risk 18 18
and adopt risk management so we can see 19 19
all of the different risks that is out there 20 20
and then put controls in place 21 21
to help bring the level of risk down to an acceptable level. 22 22
Now, when we start talking about enterprise risk management 23 23
there are lots of reasons that we adopt it. 24 24
For example, we might want to keep our confidential data, 25 25
confidential. 26 26
We want to make sure that all that customer data 27 27
and all that corporate data we have 28 28
doesn't get into the hands of unauthorized parties. 29 29
We also want to make sure that we avoid financial losses. 30 30
This can occur by people attacking our systems 31 31
and damaging our resources or attacking our data 32 32
and having data leaks. 33 33
All of this are things that can cost us money 34 34
and so by doing proper risk management, 35 35
we can minimize that and avoid those financial losses. 36 36
We also want to make sure we can avoid legal troubles. 37 37
If we have our systems hacked, 38 38
that data can then be breached, 39 39
and if it is we can have legal consequences to that, 40 40
such as civil lawsuits 41 41
for not protecting that data appropriately 42 42
and so we want to make sure 43 43
that we're avoiding any legal issues 44 44
by doing proper risk management. 45 45
Also, we want to maintain a positive brand image. 46 46
Now this is important 47 47
because even though you might be protected 48 48
from the legal ramifications 49 49
or you might have been able to mitigate the costs, 50 50
if you have some sort of a data breach 51 51
you can have your brand tarnished 52 52
and that is something that you can't get back very easily. 53 53
They say it takes decades to build a brand, 54 54
but only moments to lose it. 55 55
So we want to make sure we can maintain 56 56
a positive brand image. 57 57
Also, we want to ensure continuity of business operations, 58 58
also known COOP, the continuity of operations plan. 59 59
By doing this, we can make sure that 60 60
even if there is a natural disaster or a man-made disaster, 61 61
we can survive that and keep our businesses running. 62 62
We'll talk more about that as we go through this lesson. 63 63
Another great reason for doing risk management 64 64
is to ensure that you can establish trust 65 65
and mitigate your liability. 66 66
All of this is involved in your business relationships 67 67
between you and other businesses 68 68
as well as you and your clients 69 69
and finally, we want to make sure 70 70
we're meeting the stakeholders objectives. 71 71
We have different stakeholders, 72 72
whether those are shareholders in our company, 73 73
whether that's executives in the company, 74 74
managers or technicians, or even our customers. 75 75
All of these stakeholders have objectives, 76 76
and if we're not doing proper risk management, 77 77
we can't meet their objectives 78 78
and we can't get them what they need. 79 79
Now, just for a moment, I want to take a sidebar 80 80
and talk a little bit more about these stakeholders, 81 81
because this is a critical concept. 82 82
You as a cybersecurity technician or cybersecurity analysts 83 83
are not going to be making all the risk decisions. 84 84
You're just not. That's not your job. 85 85
Instead, these decisions had to be made 86 86
by the different business stakeholders 87 87
or by a different project management team 88 88
or by the customer service team 89 89
or whoever is the relevant stakeholder in that situation. 90 90
Now, as the cybersecurity analyst, 91 91
you are in a unique position though 92 92
to understand all the different technical risks 93 93
that exist out there and so it is your job to take those, 94 94
make them easier to understand and bring them back 95 95
to the attention of those key decision makers 96 96
and that's why it's important for you to understand 97 97
risk management and the risk management process 98 98
because you're going to have to plug into that 99 99
to be able to get your points across 100 100
and be able to get the right controls in place 101 101
to mitigate that risk. 102 102
Now, when we talk about risk management, 103 103
the go-to guide for this 104 104
is Managing Information Security Risk, 105 105
which is a publication put out by NIST. 106 106
This is the NIST special publication 800-39. 107 107
This is a great starting point for applying a process 108 108
for risk identification and assessment. 109 109
When you look inside this guide you're going to see a diagram 110 110
that looks like this. 111 111
You're going to see here the components 112 112
of information security, risk management. 113 113
This is a framework as described 114 114
by the special publication 800-39. 115 115
Now notice we have three main corners to this triangle. 116 116
We have assess, respond, and monitor 117 117
and in between all of these, you see the word frame. 118 118
Now, in between all four of these things, 119 119
we have information and communication flows 120 120
going up and down and left and right, 121 121
because all of these different pieces 122 122
of the risk management framework 123 123
are going to talk to each other so we can get information 124 124
and pass it between them. 125 125
Let's take a look at what each of these four dots represent. 126 126
When we talk about frame, this is our goal to establish 127 127
a strategic risk management framework 128 128
that is supported by decision makers, those key stakeholders 129 129
at the top tier of the organization. 130 130
When we talk about Frame, 131 131
our goal here is to create this framework 132 132
that everything else is going to reside around. 133 133
Now, as a cybersecurity analyst 134 134
you're not going to be the one creating the frame portion. 135 135
Instead, you're going to be working a lot more in the assess, 136 136
respond, and monitor. but frame is going to dictate 137 137
all three of those because it puts out 138 138
the strategic framework for your organization. 139 139
Now, next, we're going to talk about assess 140 140
and this is something you're going to do 141 141
as a cybersecurity analyst. 142 142
It is going to be your job to identify 143 143
and prioritize the different business processes 144 144
and workflows in the organization. 145 145
When you start looking at this from the assess perspective, 146 146
this is where you're doing systems assessments 147 147
to determine which assets are there 148 148
and which assets support which workflows in the business. 149 149
As you start to identify that, 150 150
you're going to be able to identify different risks 151 151
to each of those systems. 152 152
Maybe there's software that's not been patched, 153 153
that is a risk. 154 154
Maybe there's an attacker going after that type of system. 155 155
That's a risk, and these are things you have to assess 156 156
to understand what the risk level is. 157 157
We'll talk more about that later as well. 158 158
The second area we want to look at is respond. 159 159
Now, when you're going to respond, you have to mitigate 160 160
each risk factor through the deployment of managerial, 161 161
operational and technical security controls. 162 162
It's our job here to put things in place 163 163
to help lower that risk, 164 164
and we're going to talk all about what we can do 165 165
to control risk as we go through this section of the course 166 166
and finally, we need to monitor. 167 167
When we monitor, we're going to evaluate the effectiveness 168 168
of the risk response measures 169 169
and identify changes that could affect risk management 170 170
and those processes. 171 171
Now, monitor is our last thing we're going to do here, 172 172
because what we're going to do is we're going to assess something, 173 173
we're going to figure out what risk it has. 174 174
We're going to put some controls in place, 175 175
and then we're going to monitor to make sure those controls 176 176
are effective and are giving us 177 177
the risk results that we want. 178 178
Now, as we start with risk identification remember, 179 179
this takes place by evaluating all the threats, 180 180
identifying the vulnerabilities 181 181
and assessing the probability or likelihood 182 182
of an event affecting an asset or a process. 183 183
Now, risk identification really is this first step 184 184
inside of risk management that we as cybersecurity analysts 185 185
are going to take. 186 186
As we start this identification, 187 187
that helps us to assess things 188 188
and then we can respond to them and monitor them 189 189
as we go forward. 190 190
Now, the final thing I want to briefly mention here 191 191
is how do we measure risk? 192 192
Well, there are two main methods. 193 193
The first is quantitative methods. 194 194
This is where you can count something. 195 195
If I can look at the risk and quantify it 196 196
in dollars and cents, that is a quantitative method. 197 197
We're going to dig into this more later in this section 198 198
and the second way is qualitative methods. 199 199
When we talk about qualitative methods, 200 200
these are things where we kind of feel or have an opinion 201 201
about how risky something is. 202 202
We categorize these as high, medium, and low. 203 203
We don't have an exact dollar amount, 204 204
but we can kind of understand how risky something is. 205 205
Without even calculating the damage, I know how risky it is 206 206
for me to get in my car and drive to work every day. 207 207
It's a relatively low risk. 208 208
I've been driving to work for 30 years now 209 209
and I've never gotten into an accident on my way to work, 210 210
so I find that to be a low risk event. 211 211
That is a qualitative measurement though, 212 212
it is not a quantitative measurement 213 213
'cause I don't have a dollars and cents calculation to it. 214 214
I just know that it's a low risk. 215 215
We'll talk more about these concepts 216 216
as we go through this section of the course.