Narrator: Conducting an assessment. 2 2
In this lesson, we are going to talk about 3 3
conducting an assessment and what that really means. 4 4
Now, when we talk about an assessment 5 5
most businesses have to assess their different assets. 6 6
Most business assets have a specific value 7 7
associated with them. 8 8
If I look at the computer 9 9
that I'm recording this lesson on right now, 10 10
there's a value associated with it. 11 11
It costs X-amount of dollars for me 12 12
to go out and buy a new one. 13 13
If I look at a network switch there's a certain value 14 14
associated with that product if I'm going to replace it. 15 15
But there's also values that could be assigned 16 16
based on the workload that that thing is performing. 17 17
For instance, this laptop that I'm using 18 18
may have cost $1,500, but it's value to me 19 19
is higher than $1,500, because it has my data on there, 20 20
it has my videos on there, it has things that I'm recording 21 21
that aren't finished yet, 22 22
that are going to be turned into products 23 23
that can make me more than $1,500. 24 24
And so you have to think about this 25 25
when you're assigning a specific value 26 26
to a particular business asset. 27 27
Now, in security terms though, when we talk about assets 28 28
these assets are valued according to the cost created 29 29
by their loss or damage, so this laptop, 30 30
even though if I could buy a new one for $1,500 31 31
may have a exponentially higher value to me, 32 32
because if all my data is on there 33 33
and that data is worth let's say, $10,000. 34 34
Well, that could be a much higher value. 35 35
Even though the asset itself is only 1500 36 36
the data on it raises that's assets value. 37 37
And so we have to consider that as well 38 38
when we're figuring out what the asset value is. 39 39
Now, why am I bringing up all these asset values? 40 40
Well, because there are a lot of different liabilities 41 41
that could cause loss or damage to an asset, 42 42
and based on what you're doing 43 43
you're going to have to figure that out, 44 44
because that's important to how you're going to create 45 45
the value of that asset. 46 46
When you're trying to value these different assets 47 47
you have to do it according to their liabilities 48 48
against loss or damage. 49 49
And in this case, you'd be looking at three main categories. 50 50
These are business continuity, legal, and reputational. 51 51
When we talk about business continuity loss, 52 52
this is a loss that's associated 53 53
with no longer being able to fulfill contracts or orders 54 54
due to the breakdown of critical systems. 55 55
For example, if my server that gives you access 56 56
to my videos and my practice exams goes offline 57 57
that is a business continuity loss. 58 58
Now, I didn't lose the data necessarily, 59 59
but because it's offline, you can't access it. 60 60
And I can't fulfill my contract with you 61 61
which is to provide you the training you've paid for. 62 62
So that would be a business continuity loss 63 63
we have to consider. 64 64
Now, the next one we have is legal costs. 65 65
When we talk about legal costs, 66 66
this is a loss created by organizational liability 67 67
due to prosecution which would be criminal law, 68 68
or damages, which would be civil law. 69 69
Now, the important difference here 70 70
is that when you're dealing with criminal law, 71 71
somebody can go to jail. 72 72
When you're talking about civil law, 73 73
this is where somebody can sue you. 74 74
And usually you'll have to pay damages 75 75
in the form of money or restitution. 76 76
The third area that you have is reputational harm. 77 77
This is a loss created by negative publicity 78 78
and the consequential loss of market position, 79 79
or consumer trust. 80 80
For example, I'm a cybersecurity company. 81 81
If my servers have been hacked 82 82
that's going to have much more reputational harm 83 83
than actual legal costs, or business continuity costs. 84 84
Because as a cybersecurity trainer, it would look really bad 85 85
if my systems were the victim of a data breach 86 86
from some cyber attacker. 87 87
So that'd be something that we, as a company, 88 88
would be very worried about. 89 89
Now, when you start conducting these different assessments 90 90
we are going to use system assessments, 91 91
and system assessments are conducted 92 92
to better posture your organization 93 93
to reduce your risk and prevent your losses. 94 94
When we talk about a system assessment 95 95
this is the systematic identification of critical systems 96 96
by compiling an inventory of the business processes 97 97
and the tangible and intangible assets 98 98
and resources that support those processes. 99 99
Now, there are lots of different things 100 100
in this that categorize themselves under this tangible 101 101
and intangible assets and resources that I just mentioned. 102 102
Now, when you're thinking about doing a system assessment 103 103
you have to consider a lot of key areas. 104 104
For example, you might consider the people. 105 105
This is the employees, the visitors, 106 106
the suppliers, the users, the customers. 107 107
All of these are people who access that system 108 108
for some given objective. 109 109
Then we think about our tangible assets. 110 110
We talk about tangible assets, 111 111
these are things you can touch, things that you can feel. 112 112
Things like your buildings, your furniture, 113 113
your equipment, your computers, your electronic data files. 114 114
Even those are considered tangible, 115 115
because you could print them out, 116 116
or store them on a hard drive, 117 117
and any kind of paper documents you might have. 118 118
Now, when you start talking about intangibles 119 119
these are things like ideas, commercial reputation, 120 120
your brand name. 121 121
All of these things are things you can't touch or feel, 122 122
or really place a really easy to identify value on them, 123 123
but they are still important, 124 124
and so you have to consider those as well. 125 125
And finally, we have to consider your procedures. 126 126
These are things like your supply chains, 127 127
your critical procedures of how you run your company, 128 128
your standard operating procedures, your workflows, 129 129
all the ways that you do business, 130 130
because a lot of that is stuff that is unique 131 131
only to your company and there's value there, 132 132
because if you're doing it better than your competitors, 133 133
there's actually value as an intangible asset 134 134
of your company in these procedures. 135 135
So now that we've identified these four key areas, 136 136
the people, the tangible assets, the intangible assets, 137 137
and the procedures, we now have to figure out 138 138
how do these things support our business functions? 139 139
And there's lots of different functions 140 140
across your business, but the most important function 141 141
in your business is what we call 142 142
a mission essential function. 143 143
Now, this is a business, or organizational activity 144 144
that is too critical to be deferred 145 145
for anything more than a few hours, if at all. 146 146
So really, you have to ask yourself 147 147
what is your core mission? 148 148
For example, let's pretend that you worked 149 149
for the United States Air Force. 150 150
One of their mission essential functions 151 151
is to run an airport in some far off lands 152 152
during combat operations. 153 153
They have to be able to allow planes to take off and land. 154 154
If they can't do that, then nothing else matters. 155 155
Now, there's a lot of different functions, and processes, 156 156
and business things that they do to operate that airfield, 157 157
but not all of those are mission essential functions. 158 158
For example, they run something that looks like a hotel, 159 159
so that their airmen have a place to sleep at night. 160 160
They run something that looks like a cafeteria, 161 161
so people can eat, 162 162
but neither of those are mission essential functions. 163 163
If they had to delay feeding people by skipping lunch today, 164 164
and making their airmen wait until dinner, 165 165
they could do that. 166 166
They could delay it by 4, 5, 6, 7 hours. 167 167
Now, their people wouldn't be happy, but they could do that 168 168
and they could still do their mission. 169 169
But if they can't land that F-16 170 170
that's coming back from a combat mission, 171 171
well, that simply can't be delayed for a few hours, 172 172
because that pilot would run out of fuel 173 173
and the plane would crash. 174 174
So therefore, running that airport 175 175
is going to be their highest priority 176 176
and it is their mission essential function. 177 177
Now, I know that's a lot of examples 178 178
that don't really tie directly to the cyber world, 179 179
but I want you to get the concept here 180 180
of what a mission essential function is. 181 181
And I think it's a lot easier to see that 182 182
in something like the Air Force 183 183
where they have to land planes 184 184
but they don't necessarily have to have some place 185 185
that people can sleep, at least not until tonight, 186 186
so we can delay that if we needed to. 187 187
Think about your own business. 188 188
What are those things 189 189
that are mission essential functions for you? 190 190
Once you identify those 191 191
you're going to be able to build your business 192 192
and your risk management framework around that area. 193 193
For example, in my company, 194 194
one of our business essential functions 195 195
is supporting our students, 196 196
because we know that when you have a question 197 197
you want an answer right away. 198 198
Now, could I delay filming another video for my next course? 199 199
Sure, I can wait till next week if I had to, 200 200
but if I put you off for a week in answering your question, 201 201
you're going to be pretty upset. 202 202
So for us, that is a mission essential function. 203 203
And so you have to figure out what that is 204 204
for your business. 205 205
Now, another thing we have to do 206 206
as part of our system assessment 207 207
is we have to do an asset and inventory tracking. 208 208
This uses software or hardware solutions 209 209
to track and manage any assets within your organization. 210 210
Usually, in most companies, this is going to be done 211 211
as part of an asset management database. 212 212
This will contain data such as the type, the model, 213 213
the serial number, the asset ID, the location, the user, 214 214
the value, and the service information for that asset. 215 215
So, like I said, I'm using a laptop right now 216 216
as I'm recording this, I know everything about this laptop. 217 217
I know what type it is, what model it is, 218 218
what serial number it is what asset ID it is 219 219
inside my company, where it's located, 220 220
which user's assigned to it, what the value of it is. 221 221
That $1,500 or whatever that assigned asset value will be 222 222
and the service information that has all the things 223 223
that we've ever done to this laptop. 224 224
All of that is in our asset management database. 225 225
Now, another thing we are going to do 226 226
as part of our system assessment 227 227
is look at threat and vulnerability assessment data. 228 228
Now, this is an ongoing process of assessing assets 229 229
against a known set of threats and vulnerabilities. 230 230
When you're looking at this, 231 231
this is involving all of the cybersecurity analysts, 232 232
because a lot of your job is going to be focused 233 233
on conducting vulnerability scans. 234 234
Once you run those scans, you're going to look at those reports 235 235
and you're going to tie that back to the threats you're facing. 236 236
And then you're going to prioritize them 237 237
based on those threats and figure out 238 238
what should be patched first and what should be solved. 239 239
We'll talk more about that 240 240
when we get to risk prioritization.