1 1 00:00:00,300 --> 00:00:03,030 Conducting an assessment. 2 2 00:00:03,030 --> 00:00:04,950 In this lesson, we are going to talk about 3 3 00:00:04,950 --> 00:00:08,370 conducting an assessment and what that really means. 4 4 00:00:08,370 --> 00:00:10,140 Now, when we talk about an assessment 5 5 00:00:10,140 --> 00:00:13,440 most businesses have to assess their different assets. 6 6 00:00:13,440 --> 00:00:15,720 Most business assets have a specific value 7 7 00:00:15,720 --> 00:00:17,340 associated with them. 8 8 00:00:17,340 --> 00:00:18,330 If I look at the computer 9 9 00:00:18,330 --> 00:00:20,160 that I'm recording this lesson on right now, 10 10 00:00:20,160 --> 00:00:21,900 there's a value associated with it. 11 11 00:00:21,900 --> 00:00:23,430 It costs X-amount of dollars for me 12 12 00:00:23,430 --> 00:00:25,080 to go out and buy a new one. 13 13 00:00:25,080 --> 00:00:27,510 If I look at a network switch there's a certain value 14 14 00:00:27,510 --> 00:00:30,420 associated with that product if I'm going to replace it. 15 15 00:00:30,420 --> 00:00:32,370 But there's also values that could be assigned 16 16 00:00:32,370 --> 00:00:35,100 based on the workload that that thing is performing. 17 17 00:00:35,100 --> 00:00:37,050 For instance, this laptop that I'm using 18 18 00:00:37,050 --> 00:00:39,990 may have cost $1,500, but it's value to me 19 19 00:00:39,990 --> 00:00:43,050 is higher than $1,500, because it has my data on there, 20 20 00:00:43,050 --> 00:00:45,840 it has my videos on there, it has things that I'm recording 21 21 00:00:45,840 --> 00:00:46,673 that aren't finished yet, 22 22 00:00:46,673 --> 00:00:47,790 that are going to be turned into products 23 23 00:00:47,790 --> 00:00:49,980 that can make me more than $1,500. 24 24 00:00:49,980 --> 00:00:51,420 And so you have to think about this 25 25 00:00:51,420 --> 00:00:53,040 when you're assigning a specific value 26 26 00:00:53,040 --> 00:00:55,110 to a particular business asset. 27 27 00:00:55,110 --> 00:00:57,720 Now, in security terms though, when we talk about assets 28 28 00:00:57,720 --> 00:01:00,480 these assets are valued according to the cost created 29 29 00:01:00,480 --> 00:01:03,450 by their loss or damage, so this laptop, 30 30 00:01:03,450 --> 00:01:06,270 even though if I could buy a new one for $1,500 31 31 00:01:06,270 --> 00:01:09,330 may have a exponentially higher value to me, 32 32 00:01:09,330 --> 00:01:11,160 because if all my data is on there 33 33 00:01:11,160 --> 00:01:13,830 and that data is worth let's say, $10,000. 34 34 00:01:13,830 --> 00:01:16,020 Well, that could be a much higher value. 35 35 00:01:16,020 --> 00:01:18,930 Even though the asset itself is only 1500 36 36 00:01:18,930 --> 00:01:21,660 the data on it raises that's assets value. 37 37 00:01:21,660 --> 00:01:23,220 And so we have to consider that as well 38 38 00:01:23,220 --> 00:01:26,010 when we're figuring out what the asset value is. 39 39 00:01:26,010 --> 00:01:28,770 Now, why am I bringing up all these asset values? 40 40 00:01:28,770 --> 00:01:31,620 Well, because there are a lot of different liabilities 41 41 00:01:31,620 --> 00:01:34,290 that could cause loss or damage to an asset, 42 42 00:01:34,290 --> 00:01:35,670 and based on what you're doing 43 43 00:01:35,670 --> 00:01:37,200 you're going to have to figure that out, 44 44 00:01:37,200 --> 00:01:39,450 because that's important to how you're going to create 45 45 00:01:39,450 --> 00:01:41,310 the value of that asset. 46 46 00:01:41,310 --> 00:01:43,290 When you're trying to value these different assets 47 47 00:01:43,290 --> 00:01:45,270 you have to do it according to their liabilities 48 48 00:01:45,270 --> 00:01:46,860 against loss or damage. 49 49 00:01:46,860 --> 00:01:49,650 And in this case, you'd be looking at three main categories. 50 50 00:01:49,650 --> 00:01:53,220 These are business continuity, legal, and reputational. 51 51 00:01:53,220 --> 00:01:55,320 When we talk about business continuity loss, 52 52 00:01:55,320 --> 00:01:56,760 this is a loss that's associated 53 53 00:01:56,760 --> 00:01:59,880 with no longer being able to fulfill contracts or orders 54 54 00:01:59,880 --> 00:02:02,580 due to the breakdown of critical systems. 55 55 00:02:02,580 --> 00:02:05,430 For example, if my server that gives you access 56 56 00:02:05,430 --> 00:02:08,310 to my videos and my practice exams goes offline 57 57 00:02:08,310 --> 00:02:10,590 that is a business continuity loss. 58 58 00:02:10,590 --> 00:02:12,210 Now, I didn't lose the data necessarily, 59 59 00:02:12,210 --> 00:02:14,730 but because it's offline, you can't access it. 60 60 00:02:14,730 --> 00:02:16,770 And I can't fulfill my contract with you 61 61 00:02:16,770 --> 00:02:19,110 which is to provide you the training you've paid for. 62 62 00:02:19,110 --> 00:02:20,700 So that would be a business continuity loss 63 63 00:02:20,700 --> 00:02:22,200 we have to consider. 64 64 00:02:22,200 --> 00:02:24,420 Now, the next one we have is legal costs. 65 65 00:02:24,420 --> 00:02:25,710 When we talk about legal costs, 66 66 00:02:25,710 --> 00:02:28,590 this is a loss created by organizational liability 67 67 00:02:28,590 --> 00:02:31,110 due to prosecution which would be criminal law, 68 68 00:02:31,110 --> 00:02:33,630 or damages, which would be civil law. 69 69 00:02:33,630 --> 00:02:34,920 Now, the important difference here 70 70 00:02:34,920 --> 00:02:36,630 is that when you're dealing with criminal law, 71 71 00:02:36,630 --> 00:02:38,370 somebody can go to jail. 72 72 00:02:38,370 --> 00:02:39,990 When you're talking about civil law, 73 73 00:02:39,990 --> 00:02:41,610 this is where somebody can sue you. 74 74 00:02:41,610 --> 00:02:43,050 And usually you'll have to pay damages 75 75 00:02:43,050 --> 00:02:45,690 in the form of money or restitution. 76 76 00:02:45,690 --> 00:02:48,660 The third area that you have is reputational harm. 77 77 00:02:48,660 --> 00:02:51,000 This is a loss created by negative publicity 78 78 00:02:51,000 --> 00:02:53,190 and the consequential loss of market position, 79 79 00:02:53,190 --> 00:02:54,840 or consumer trust. 80 80 00:02:54,840 --> 00:02:57,330 For example, I'm a cybersecurity company. 81 81 00:02:57,330 --> 00:02:59,130 If my servers have been hacked 82 82 00:02:59,130 --> 00:03:01,710 that's going to have much more reputational harm 83 83 00:03:01,710 --> 00:03:04,860 than actual legal costs, or business continuity costs. 84 84 00:03:04,860 --> 00:03:07,740 Because as a cybersecurity trainer, it would look really bad 85 85 00:03:07,740 --> 00:03:10,470 if my systems were the victim of a data breach 86 86 00:03:10,470 --> 00:03:12,240 from some cyber attacker. 87 87 00:03:12,240 --> 00:03:13,620 So that'd be something that we, as a company, 88 88 00:03:13,620 --> 00:03:15,540 would be very worried about. 89 89 00:03:15,540 --> 00:03:17,700 Now, when you start conducting these different assessments 90 90 00:03:17,700 --> 00:03:19,710 we are going to use system assessments, 91 91 00:03:19,710 --> 00:03:21,270 and system assessments are conducted 92 92 00:03:21,270 --> 00:03:23,430 to better posture your organization 93 93 00:03:23,430 --> 00:03:26,100 to reduce your risk and prevent your losses. 94 94 00:03:26,100 --> 00:03:28,020 When we talk about a system assessment 95 95 00:03:28,020 --> 00:03:31,380 this is the systematic identification of critical systems 96 96 00:03:31,380 --> 00:03:34,080 by compiling an inventory of the business processes 97 97 00:03:34,080 --> 00:03:36,300 and the tangible and intangible assets 98 98 00:03:36,300 --> 00:03:39,360 and resources that support those processes. 99 99 00:03:39,360 --> 00:03:40,860 Now, there are lots of different things 100 100 00:03:40,860 --> 00:03:43,500 in this that categorize themselves under this tangible 101 101 00:03:43,500 --> 00:03:47,190 and intangible assets and resources that I just mentioned. 102 102 00:03:47,190 --> 00:03:49,110 Now, when you're thinking about doing a system assessment 103 103 00:03:49,110 --> 00:03:50,970 you have to consider a lot of key areas. 104 104 00:03:50,970 --> 00:03:53,370 For example, you might consider the people. 105 105 00:03:53,370 --> 00:03:55,290 This is the employees, the visitors, 106 106 00:03:55,290 --> 00:03:57,990 the suppliers, the users, the customers. 107 107 00:03:57,990 --> 00:04:00,450 All of these are people who access that system 108 108 00:04:00,450 --> 00:04:02,340 for some given objective. 109 109 00:04:02,340 --> 00:04:04,410 Then we think about our tangible assets. 110 110 00:04:04,410 --> 00:04:05,730 We talk about tangible assets, 111 111 00:04:05,730 --> 00:04:08,250 these are things you can touch, things that you can feel. 112 112 00:04:08,250 --> 00:04:10,530 Things like your buildings, your furniture, 113 113 00:04:10,530 --> 00:04:13,830 your equipment, your computers, your electronic data files. 114 114 00:04:13,830 --> 00:04:15,240 Even those are considered tangible, 115 115 00:04:15,240 --> 00:04:16,650 because you could print them out, 116 116 00:04:16,650 --> 00:04:18,060 or store them on a hard drive, 117 117 00:04:18,060 --> 00:04:20,610 and any kind of paper documents you might have. 118 118 00:04:20,610 --> 00:04:22,710 Now, when you start talking about intangibles 119 119 00:04:22,710 --> 00:04:25,830 these are things like ideas, commercial reputation, 120 120 00:04:25,830 --> 00:04:27,090 your brand name. 121 121 00:04:27,090 --> 00:04:29,820 All of these things are things you can't touch or feel, 122 122 00:04:29,820 --> 00:04:33,000 or really place a really easy to identify value on them, 123 123 00:04:33,000 --> 00:04:34,770 but they are still important, 124 124 00:04:34,770 --> 00:04:36,660 and so you have to consider those as well. 125 125 00:04:36,660 --> 00:04:38,910 And finally, we have to consider your procedures. 126 126 00:04:38,910 --> 00:04:40,800 These are things like your supply chains, 127 127 00:04:40,800 --> 00:04:43,410 your critical procedures of how you run your company, 128 128 00:04:43,410 --> 00:04:46,080 your standard operating procedures, your workflows, 129 129 00:04:46,080 --> 00:04:47,610 all the ways that you do business, 130 130 00:04:47,610 --> 00:04:49,530 because a lot of that is stuff that is unique 131 131 00:04:49,530 --> 00:04:51,600 only to your company and there's value there, 132 132 00:04:51,600 --> 00:04:53,790 because if you're doing it better than your competitors, 133 133 00:04:53,790 --> 00:04:56,130 there's actually value as an intangible asset 134 134 00:04:56,130 --> 00:04:58,890 of your company in these procedures. 135 135 00:04:58,890 --> 00:05:01,410 So now that we've identified these four key areas, 136 136 00:05:01,410 --> 00:05:04,410 the people, the tangible assets, the intangible assets, 137 137 00:05:04,410 --> 00:05:06,780 and the procedures, we now have to figure out 138 138 00:05:06,780 --> 00:05:10,440 how do these things support our business functions? 139 139 00:05:10,440 --> 00:05:11,970 And there's lots of different functions 140 140 00:05:11,970 --> 00:05:14,790 across your business, but the most important function 141 141 00:05:14,790 --> 00:05:16,170 in your business is what we call 142 142 00:05:16,170 --> 00:05:18,360 a mission essential function. 143 143 00:05:18,360 --> 00:05:20,820 Now, this is a business, or organizational activity 144 144 00:05:20,820 --> 00:05:22,590 that is too critical to be deferred 145 145 00:05:22,590 --> 00:05:25,830 for anything more than a few hours, if at all. 146 146 00:05:25,830 --> 00:05:27,720 So really, you have to ask yourself 147 147 00:05:27,720 --> 00:05:29,700 what is your core mission? 148 148 00:05:29,700 --> 00:05:31,860 For example, let's pretend that you worked 149 149 00:05:31,860 --> 00:05:33,870 for the United States Air Force. 150 150 00:05:33,870 --> 00:05:35,700 One of their mission essential functions 151 151 00:05:35,700 --> 00:05:38,040 is to run an airport in some far off lands 152 152 00:05:38,040 --> 00:05:39,810 during combat operations. 153 153 00:05:39,810 --> 00:05:42,450 They have to be able to allow planes to take off and land. 154 154 00:05:42,450 --> 00:05:45,390 If they can't do that, then nothing else matters. 155 155 00:05:45,390 --> 00:05:48,060 Now, there's a lot of different functions, and processes, 156 156 00:05:48,060 --> 00:05:51,330 and business things that they do to operate that airfield, 157 157 00:05:51,330 --> 00:05:54,690 but not all of those are mission essential functions. 158 158 00:05:54,690 --> 00:05:57,390 For example, they run something that looks like a hotel, 159 159 00:05:57,390 --> 00:05:59,760 so that their airmen have a place to sleep at night. 160 160 00:05:59,760 --> 00:06:01,350 They run something that looks like a cafeteria, 161 161 00:06:01,350 --> 00:06:02,820 so people can eat, 162 162 00:06:02,820 --> 00:06:05,220 but neither of those are mission essential functions. 163 163 00:06:05,220 --> 00:06:08,160 If they had to delay feeding people by skipping lunch today, 164 164 00:06:08,160 --> 00:06:09,990 and making their airmen wait until dinner, 165 165 00:06:09,990 --> 00:06:10,823 they could do that. 166 166 00:06:10,823 --> 00:06:13,560 They could delay it by 4, 5, 6, 7 hours. 167 167 00:06:13,560 --> 00:06:16,410 Now, their people wouldn't be happy, but they could do that 168 168 00:06:16,410 --> 00:06:18,270 and they could still do their mission. 169 169 00:06:18,270 --> 00:06:20,250 But if they can't land that F-16 170 170 00:06:20,250 --> 00:06:22,050 that's coming back from a combat mission, 171 171 00:06:22,050 --> 00:06:24,900 well, that simply can't be delayed for a few hours, 172 172 00:06:24,900 --> 00:06:26,580 because that pilot would run out of fuel 173 173 00:06:26,580 --> 00:06:27,930 and the plane would crash. 174 174 00:06:27,930 --> 00:06:29,700 So therefore, running that airport 175 175 00:06:29,700 --> 00:06:31,470 is going to be their highest priority 176 176 00:06:31,470 --> 00:06:34,110 and it is their mission essential function. 177 177 00:06:34,110 --> 00:06:35,580 Now, I know that's a lot of examples 178 178 00:06:35,580 --> 00:06:38,310 that don't really tie directly to the cyber world, 179 179 00:06:38,310 --> 00:06:40,140 but I want you to get the concept here 180 180 00:06:40,140 --> 00:06:41,880 of what a mission essential function is. 181 181 00:06:41,880 --> 00:06:43,470 And I think it's a lot easier to see that 182 182 00:06:43,470 --> 00:06:45,180 in something like the Air Force 183 183 00:06:45,180 --> 00:06:46,440 where they have to land planes 184 184 00:06:46,440 --> 00:06:48,210 but they don't necessarily have to have some place 185 185 00:06:48,210 --> 00:06:50,370 that people can sleep, at least not until tonight, 186 186 00:06:50,370 --> 00:06:52,470 so we can delay that if we needed to. 187 187 00:06:52,470 --> 00:06:53,790 Think about your own business. 188 188 00:06:53,790 --> 00:06:54,623 What are those things 189 189 00:06:54,623 --> 00:06:56,880 that are mission essential functions for you? 190 190 00:06:56,880 --> 00:06:58,440 Once you identify those 191 191 00:06:58,440 --> 00:06:59,820 you're going to be able to build your business 192 192 00:06:59,820 --> 00:07:02,970 and your risk management framework around that area. 193 193 00:07:02,970 --> 00:07:04,860 For example, in my company, 194 194 00:07:04,860 --> 00:07:06,630 one of our business essential functions 195 195 00:07:06,630 --> 00:07:08,280 is supporting our students, 196 196 00:07:08,280 --> 00:07:09,960 because we know that when you have a question 197 197 00:07:09,960 --> 00:07:11,790 you want an answer right away. 198 198 00:07:11,790 --> 00:07:14,910 Now, could I delay filming another video for my next course? 199 199 00:07:14,910 --> 00:07:17,130 Sure, I can wait till next week if I had to, 200 200 00:07:17,130 --> 00:07:19,320 but if I put you off for a week in answering your question, 201 201 00:07:19,320 --> 00:07:20,730 you're going to be pretty upset. 202 202 00:07:20,730 --> 00:07:23,100 So for us, that is a mission essential function. 203 203 00:07:23,100 --> 00:07:24,570 And so you have to figure out what that is 204 204 00:07:24,570 --> 00:07:26,130 for your business. 205 205 00:07:26,130 --> 00:07:27,180 Now, another thing we have to do 206 206 00:07:27,180 --> 00:07:28,680 as part of our system assessment 207 207 00:07:28,680 --> 00:07:31,710 is we have to do an asset and inventory tracking. 208 208 00:07:31,710 --> 00:07:33,720 This uses software or hardware solutions 209 209 00:07:33,720 --> 00:07:37,230 to track and manage any assets within your organization. 210 210 00:07:37,230 --> 00:07:39,870 Usually, in most companies, this is going to be done 211 211 00:07:39,870 --> 00:07:42,330 as part of an asset management database. 212 212 00:07:42,330 --> 00:07:45,360 This will contain data such as the type, the model, 213 213 00:07:45,360 --> 00:07:49,440 the serial number, the asset ID, the location, the user, 214 214 00:07:49,440 --> 00:07:53,130 the value, and the service information for that asset. 215 215 00:07:53,130 --> 00:07:55,260 So, like I said, I'm using a laptop right now 216 216 00:07:55,260 --> 00:07:58,500 as I'm recording this, I know everything about this laptop. 217 217 00:07:58,500 --> 00:08:00,390 I know what type it is, what model it is, 218 218 00:08:00,390 --> 00:08:02,490 what serial number it is what asset ID it is 219 219 00:08:02,490 --> 00:08:04,680 inside my company, where it's located, 220 220 00:08:04,680 --> 00:08:07,200 which user's assigned to it, what the value of it is. 221 221 00:08:07,200 --> 00:08:10,920 That $1,500 or whatever that assigned asset value will be 222 222 00:08:10,920 --> 00:08:13,500 and the service information that has all the things 223 223 00:08:13,500 --> 00:08:15,420 that we've ever done to this laptop. 224 224 00:08:15,420 --> 00:08:18,210 All of that is in our asset management database. 225 225 00:08:18,210 --> 00:08:19,290 Now, another thing we are going to do 226 226 00:08:19,290 --> 00:08:20,910 as part of our system assessment 227 227 00:08:20,910 --> 00:08:23,670 is look at threat and vulnerability assessment data. 228 228 00:08:23,670 --> 00:08:26,370 Now, this is an ongoing process of assessing assets 229 229 00:08:26,370 --> 00:08:29,280 against a known set of threats and vulnerabilities. 230 230 00:08:29,280 --> 00:08:30,360 When you're looking at this, 231 231 00:08:30,360 --> 00:08:33,060 this is involving all of the cybersecurity analysts, 232 232 00:08:33,060 --> 00:08:35,250 because a lot of your job is going to be focused 233 233 00:08:35,250 --> 00:08:37,560 on conducting vulnerability scans. 234 234 00:08:37,560 --> 00:08:39,990 Once you run those scans, you're going to look at those reports 235 235 00:08:39,990 --> 00:08:42,360 and you're going to tie that back to the threats you're facing. 236 236 00:08:42,360 --> 00:08:43,860 And then you're going to prioritize them 237 237 00:08:43,860 --> 00:08:45,510 based on those threats and figure out 238 238 00:08:45,510 --> 00:08:48,570 what should be patched first and what should be solved. 239 239 00:08:48,570 --> 00:08:49,650 We'll talk more about that 240 240 00:08:49,650 --> 00:08:51,423 when we get to risk prioritization.