1 1 00:00:00,090 --> 00:00:01,080 In this lesson, 2 2 00:00:01,080 --> 00:00:03,780 we're going to talk about risk calculations. 3 3 00:00:03,780 --> 00:00:05,610 Now, there are two very popular ways 4 4 00:00:05,610 --> 00:00:07,740 of performing risk calculations. 5 5 00:00:07,740 --> 00:00:10,110 These are known as quantitative and qualitative 6 6 00:00:10,110 --> 00:00:11,760 risk calculations. 7 7 00:00:11,760 --> 00:00:14,670 Let's start out with quantitative risk calculations. 8 8 00:00:14,670 --> 00:00:17,160 Now, a quantitative risk calculation is a method 9 9 00:00:17,160 --> 00:00:19,500 of risk assessment that uses mathematical 10 10 00:00:19,500 --> 00:00:22,230 and statistical techniques to assign numerical values 11 11 00:00:22,230 --> 00:00:25,440 to the likelihood and impact of potential threats. 12 12 00:00:25,440 --> 00:00:27,240 This involves calculating the probability 13 13 00:00:27,240 --> 00:00:29,400 of a specific threat that's going to occur 14 14 00:00:29,400 --> 00:00:31,350 as well as the magnitude of the impact 15 15 00:00:31,350 --> 00:00:33,930 if that threat was to materialize. 16 16 00:00:33,930 --> 00:00:36,060 Our result of this calculation is going to be 17 17 00:00:36,060 --> 00:00:38,520 a numerical representation of the risk associated 18 18 00:00:38,520 --> 00:00:40,260 with a particular threat. 19 19 00:00:40,260 --> 00:00:42,360 Now, quantitative risk calculation is really 20 20 00:00:42,360 --> 00:00:43,980 just a simple formula. 21 21 00:00:43,980 --> 00:00:47,250 Risk equals probability times impact. 22 22 00:00:47,250 --> 00:00:48,150 Now, the probability 23 23 00:00:48,150 --> 00:00:50,400 of a threat occurring is usually going to be expressed 24 24 00:00:50,400 --> 00:00:54,510 as a percentage, for example, 50% or 90% 25 25 00:00:54,510 --> 00:00:56,190 or you could write this as a decimal 26 26 00:00:56,190 --> 00:01:00,960 like 0.5 for 50% or 0.9 for 90%. 27 27 00:01:00,960 --> 00:01:03,120 Let's take the example of 50%. 28 28 00:01:03,120 --> 00:01:05,460 Now, if you have a probability of 50% 29 29 00:01:05,460 --> 00:01:06,690 this means the likelihood 30 30 00:01:06,690 --> 00:01:09,660 of that threat occurring is just as likely to happen 31 31 00:01:09,660 --> 00:01:11,430 as it is not to happen. 32 32 00:01:11,430 --> 00:01:13,800 Basically, it's just a coin toss. 33 33 00:01:13,800 --> 00:01:16,800 Now, on the other hand, if your probability is 90% 34 34 00:01:16,800 --> 00:01:18,090 this means that the likelihood 35 35 00:01:18,090 --> 00:01:21,150 of that thing happening is nine times as likely 36 36 00:01:21,150 --> 00:01:23,130 as that thing not happening. 37 37 00:01:23,130 --> 00:01:26,730 So if we see a higher probability, like 90% 38 38 00:01:26,730 --> 00:01:28,860 it is something we probably need to protect ourselves 39 39 00:01:28,860 --> 00:01:30,630 against because it's very likely 40 40 00:01:30,630 --> 00:01:33,150 that that threat is going to materialize. 41 41 00:01:33,150 --> 00:01:36,510 Now, the second part of our formula involves the impact. 42 42 00:01:36,510 --> 00:01:38,160 The impact is typically measured 43 43 00:01:38,160 --> 00:01:39,630 in terms of the financial loss 44 44 00:01:39,630 --> 00:01:43,200 or damage that would result if the threat was materialized. 45 45 00:01:43,200 --> 00:01:46,500 Basically, how bad or how severe is this threat going to be 46 46 00:01:46,500 --> 00:01:48,330 if it actually happens? 47 47 00:01:48,330 --> 00:01:50,310 Now in the physical world, let's say I have 48 48 00:01:50,310 --> 00:01:52,590 a small bomb that's going to detonate in my backyard 49 49 00:01:52,590 --> 00:01:55,860 like a firecracker, that would have a very low impact, 50 50 00:01:55,860 --> 00:01:58,710 but if I exploded a large bomb, it might take 51 51 00:01:58,710 --> 00:02:01,920 down my entire house or maybe even my neighbor's houses too. 52 52 00:02:01,920 --> 00:02:04,260 So it would have a really large impact. 53 53 00:02:04,260 --> 00:02:06,810 In the cyber world, we might look at two threats 54 54 00:02:06,810 --> 00:02:08,670 such as one where somebody's able to access 55 55 00:02:08,670 --> 00:02:10,950 one of our testing servers and download a video 56 56 00:02:10,950 --> 00:02:12,570 from a file containing a lesson 57 57 00:02:12,570 --> 00:02:15,660 from a retired certification exam, like the first version 58 58 00:02:15,660 --> 00:02:17,580 of the CySA+ exam. 59 59 00:02:17,580 --> 00:02:20,130 If that happened, it would be a pretty low impact 60 60 00:02:20,130 --> 00:02:22,620 to us because that exam is no longer offered 61 61 00:02:22,620 --> 00:02:24,780 and that video is really old and out of date 62 62 00:02:24,780 --> 00:02:27,540 and we've refiled it several times since then. 63 63 00:02:27,540 --> 00:02:30,000 On the other hand, if we had somebody who was able to hack 64 64 00:02:30,000 --> 00:02:33,060 into our production servers and download our entire database 65 65 00:02:33,060 --> 00:02:34,890 of student names and emails 66 66 00:02:34,890 --> 00:02:37,470 that would have a much larger impact for our company 67 67 00:02:37,470 --> 00:02:38,970 and so it would have a higher value 68 68 00:02:38,970 --> 00:02:42,600 for this impact equation in terms of the potential risk. 69 69 00:02:42,600 --> 00:02:44,970 Now, if we go back to our formula for risk, we said 70 70 00:02:44,970 --> 00:02:48,390 that risk equals probability times impact, and so we can see 71 71 00:02:48,390 --> 00:02:50,760 that we can multiply these two values together 72 72 00:02:50,760 --> 00:02:52,380 to calculate the overall risk 73 73 00:02:52,380 --> 00:02:54,780 using this mathematical formula. 74 74 00:02:54,780 --> 00:02:57,000 Now, this type of quantitative risk calculation 75 75 00:02:57,000 --> 00:02:59,040 is really useful for an organization 76 76 00:02:59,040 --> 00:03:01,110 because it allows us to better prioritize our risk 77 77 00:03:01,110 --> 00:03:03,510 management efforts by identifying which risks 78 78 00:03:03,510 --> 00:03:05,400 are considered the most likely to happen 79 79 00:03:05,400 --> 00:03:07,530 and have the greatest potential impact 80 80 00:03:07,530 --> 00:03:09,330 against our organization. 81 81 00:03:09,330 --> 00:03:11,790 Additionally, it provides a clear and objective way 82 82 00:03:11,790 --> 00:03:14,340 for us to communicate risk up to our stakeholders 83 83 00:03:14,340 --> 00:03:17,760 and to make data-driven decisions about risk management. 84 84 00:03:17,760 --> 00:03:20,010 Now, some other quantitative risk calculations 85 85 00:03:20,010 --> 00:03:23,250 we're going to use are things like our single loss expectancy 86 86 00:03:23,250 --> 00:03:25,890 and annual loss expectancy for a given asset 87 87 00:03:25,890 --> 00:03:27,450 such as a server, a system, 88 88 00:03:27,450 --> 00:03:29,820 or the entire enterprise network. 89 89 00:03:29,820 --> 00:03:33,480 Now, a single loss expectancy, which is written as SLE 90 90 00:03:33,480 --> 00:03:35,460 is a metric that's used in quantitative risk 91 91 00:03:35,460 --> 00:03:38,280 calculations to determine the expected financial loss 92 92 00:03:38,280 --> 00:03:39,720 from a single event. 93 93 00:03:39,720 --> 00:03:40,680 It's going to be calculated 94 94 00:03:40,680 --> 00:03:43,950 by multiplying the asset value by the exposure factor 95 95 00:03:43,950 --> 00:03:46,800 and then we represent all of this using the formula. 96 96 00:03:46,800 --> 00:03:51,800 SLE equals AV for asset value times EF for exposure factor. 97 97 00:03:52,800 --> 00:03:56,400 Now, the asset value or AV is going to be the monetary value 98 98 00:03:56,400 --> 00:03:58,410 of the asset that is at risk 99 99 00:03:58,410 --> 00:04:01,110 and the exposure factor or EF is a percentage 100 100 00:04:01,110 --> 00:04:04,170 of loss that would result from a specific threat. 101 101 00:04:04,170 --> 00:04:05,310 Now, let's say for example 102 102 00:04:05,310 --> 00:04:07,140 an organization has an asset valued 103 103 00:04:07,140 --> 00:04:08,760 at a hundred thousand dollars 104 104 00:04:08,760 --> 00:04:12,360 and the exposure factor for a particular threat is 10% 105 105 00:04:12,360 --> 00:04:16,624 then our SLE would be $10,000 because $100,000 106 106 00:04:16,624 --> 00:04:21,624 times 10% or 0.10 is going to equal 10,000. 107 107 00:04:21,780 --> 00:04:24,120 This means that if the threat actually occurs 108 108 00:04:24,120 --> 00:04:27,450 the organization can expect to lose $10,000. 109 109 00:04:27,450 --> 00:04:28,920 Now, people often ask me 110 110 00:04:28,920 --> 00:04:30,810 how do we calculate the exposure factor 111 111 00:04:30,810 --> 00:04:32,790 for this SLE equation? 112 112 00:04:32,790 --> 00:04:35,820 Well, the exposure factor or EF is really the amount 113 113 00:04:35,820 --> 00:04:39,030 of the assets value that'll be lost for a specific threat. 114 114 00:04:39,030 --> 00:04:40,140 So let me give you a couple 115 115 00:04:40,140 --> 00:04:42,990 of examples of this to help solidify this concept. 116 116 00:04:42,990 --> 00:04:43,823 Let's pretend 117 117 00:04:43,823 --> 00:04:46,230 that I just built a new web application that runs 118 118 00:04:46,230 --> 00:04:49,020 across a clustered server with 10 servers. 119 119 00:04:49,020 --> 00:04:50,820 If I was calculating the exposure factor 120 120 00:04:50,820 --> 00:04:52,140 for that server cluster 121 121 00:04:52,140 --> 00:04:53,910 and two of the 10 servers were unusable 122 122 00:04:53,910 --> 00:04:55,530 because of a ransomware attack 123 123 00:04:55,530 --> 00:04:58,920 then I now have eight out of 10 servers that remain usable 124 124 00:04:58,920 --> 00:05:00,540 and this gives me an exposure factor 125 125 00:05:00,540 --> 00:05:03,960 of 20% because two unusable servers divided 126 126 00:05:03,960 --> 00:05:08,960 by 10 total servers is 20% or 0.2 for my exposure factor. 127 127 00:05:09,180 --> 00:05:11,280 Or let's pretend I have an office building 128 128 00:05:11,280 --> 00:05:13,230 and I have 20 offices inside of it, 129 129 00:05:13,230 --> 00:05:15,720 but we had a pipe burst and it flooded one 130 130 00:05:15,720 --> 00:05:18,180 of those offices, and now that's unusable. 131 131 00:05:18,180 --> 00:05:20,010 This means I now have 19 132 132 00:05:20,010 --> 00:05:22,080 of the 20 offices that are still available 133 133 00:05:22,080 --> 00:05:23,130 for people to use. 134 134 00:05:23,130 --> 00:05:27,360 So I have one unusable office divided by 20 total offices 135 135 00:05:27,360 --> 00:05:32,250 and this gives me 5% or 0.05 as my exposure factor. 136 136 00:05:32,250 --> 00:05:34,860 Now, this single loss expectancy is a really important 137 137 00:05:34,860 --> 00:05:36,210 metric for us to consider 138 138 00:05:36,210 --> 00:05:37,770 because it allows our organizations 139 139 00:05:37,770 --> 00:05:40,650 to determine the expected loss from a single event 140 140 00:05:40,650 --> 00:05:43,230 and then prioritize our risk management efforts. 141 141 00:05:43,230 --> 00:05:45,480 This single loss expectancy can also be used 142 142 00:05:45,480 --> 00:05:46,980 to help establish the cost benefit 143 143 00:05:46,980 --> 00:05:48,690 of different risk management strategies 144 144 00:05:48,690 --> 00:05:50,400 and it can help us to develop a budget 145 145 00:05:50,400 --> 00:05:53,880 for risk management overall inside of our organization. 146 146 00:05:53,880 --> 00:05:56,190 Now, the single loss expectancy is really useful 147 147 00:05:56,190 --> 00:05:58,830 in understanding the expected cost of a single event 148 148 00:05:58,830 --> 00:06:02,010 or threat that's being realized, but it doesn't account 149 149 00:06:02,010 --> 00:06:04,800 for the likelihood of multiple events occurring. 150 150 00:06:04,800 --> 00:06:07,470 To understand the annual cost of a given threat though 151 151 00:06:07,470 --> 00:06:09,540 we need to instead calculate the annual rate 152 152 00:06:09,540 --> 00:06:11,550 of occurrence known as the ARO 153 153 00:06:11,550 --> 00:06:15,690 and the annualized lost expectancy known as the ALE. 154 154 00:06:15,690 --> 00:06:17,160 Now, the annual rate of occurrence 155 155 00:06:17,160 --> 00:06:19,140 or ARO is the number of times 156 156 00:06:19,140 --> 00:06:22,320 per year that a specific threat is expected to occur. 157 157 00:06:22,320 --> 00:06:24,270 The easiest way to calculate this number 158 158 00:06:24,270 --> 00:06:25,920 is to simply count the number of times 159 159 00:06:25,920 --> 00:06:28,110 that that thing happened in a given year. 160 160 00:06:28,110 --> 00:06:31,770 For example, if I'm calculating the ARO for data breaches 161 161 00:06:31,770 --> 00:06:33,459 I might look at the organization's history 162 162 00:06:33,459 --> 00:06:36,840 and see that they had three breaches in the last 12 months. 163 163 00:06:36,840 --> 00:06:40,560 So their ARO or annual rate of occurrence is three, 164 164 00:06:40,560 --> 00:06:43,080 because they had three breaches in one year. 165 165 00:06:43,080 --> 00:06:46,080 But what if something happens less frequently? 166 166 00:06:46,080 --> 00:06:48,750 Well, then you're going to have to get a number less than one 167 167 00:06:48,750 --> 00:06:50,190 and you really can't simply count them 168 168 00:06:50,190 --> 00:06:51,660 up during a single year. 169 169 00:06:51,660 --> 00:06:54,300 So instead, we need to calculate the ARO 170 170 00:06:54,300 --> 00:06:56,310 by counting the number of occurrences of a threat 171 171 00:06:56,310 --> 00:06:58,590 in a given period of time and then dividing it 172 172 00:06:58,590 --> 00:07:01,080 by the total number of years in that period. 173 173 00:07:01,080 --> 00:07:04,290 So our basic formula for the annual rate of occurrence 174 174 00:07:04,290 --> 00:07:06,810 is the number of times the threat occurred divided 175 175 00:07:06,810 --> 00:07:09,600 by the number of years in the period that we counted. 176 176 00:07:09,600 --> 00:07:13,530 For example, if a threat occurs one time every three years 177 177 00:07:13,530 --> 00:07:16,290 the annual rate of occurrence would be one divided by three 178 178 00:07:16,290 --> 00:07:20,550 or one third, which equals 0.33 occurrences per year. 179 179 00:07:20,550 --> 00:07:23,160 Now that we have our SLE and our ARO 180 180 00:07:23,160 --> 00:07:25,740 we can now calculate the annual loss expectancy 181 181 00:07:25,740 --> 00:07:27,600 or the ALE. 182 182 00:07:27,600 --> 00:07:30,240 Now, the annual loss expectancy is the expected 183 183 00:07:30,240 --> 00:07:33,210 financial loss from multiple events during a year. 184 184 00:07:33,210 --> 00:07:35,400 The annual loss expectancy is calculated 185 185 00:07:35,400 --> 00:07:37,650 by multiplying the single loss expectancy 186 186 00:07:37,650 --> 00:07:40,230 by the annual rate of occurrence, and the formula 187 187 00:07:40,230 --> 00:07:44,730 for this is ALE equals SLE times ARO. 188 188 00:07:44,730 --> 00:07:45,780 For example, 189 189 00:07:45,780 --> 00:07:49,500 if an organization has a single loss expectancy of $10,000 190 190 00:07:49,500 --> 00:07:53,130 an annual rate of occurrence of 0.33 occurrences per year 191 191 00:07:53,130 --> 00:07:56,543 the annual loss expectancy is going to be $3,333.33 192 192 00:07:59,340 --> 00:08:02,450 because I have $10,000 times one third 193 193 00:08:02,450 --> 00:08:04,980 or 0.33 occurrences per year 194 194 00:08:04,980 --> 00:08:09,570 and this gives me $3,333.33. 195 195 00:08:09,570 --> 00:08:12,360 Which is what the organization can expect to lose each year 196 196 00:08:12,360 --> 00:08:14,220 due to that specific threat. 197 197 00:08:14,220 --> 00:08:16,260 Now as I'm doing my risk management 198 198 00:08:16,260 --> 00:08:18,480 and trying to mitigate that risk, I'm going to look 199 199 00:08:18,480 --> 00:08:20,580 at this and then decide is it worth protecting 200 200 00:08:20,580 --> 00:08:22,470 against this particular risk? 201 201 00:08:22,470 --> 00:08:25,500 For example, let's say you called me up and said, Jason 202 202 00:08:25,500 --> 00:08:27,960 I'm a cybersecurity analyst, and I can mitigate that risk 203 203 00:08:27,960 --> 00:08:32,280 for you 100% and it'll only cost you $25,000 per year. 204 204 00:08:32,280 --> 00:08:35,850 I would say no thank you because I don't want to spend $25,000 205 205 00:08:35,850 --> 00:08:38,287 per year to solve a risk that is only costing me 206 206 00:08:38,287 --> 00:08:42,120 $3,333.33 per year. 207 207 00:08:42,120 --> 00:08:45,660 In fact, I can have this risk occur seven times more often 208 208 00:08:45,660 --> 00:08:46,740 and it would still be cheaper 209 209 00:08:46,740 --> 00:08:48,750 for me to simply allow that event to occur 210 210 00:08:48,750 --> 00:08:51,360 than to pay you to protect me against it. 211 211 00:08:51,360 --> 00:08:53,430 Now, on the other hand, if you had a security 212 212 00:08:53,430 --> 00:08:55,140 as a service solution that would only cost me 213 213 00:08:55,140 --> 00:08:57,660 a hundred dollars per month, I would probably buy it 214 214 00:08:57,660 --> 00:09:00,630 because a hundred dollars a month is only $1,200 per year 215 215 00:09:00,630 --> 00:09:02,250 and that's almost one third the cost 216 216 00:09:02,250 --> 00:09:04,650 of the annual loss expectancy that I calculated 217 217 00:09:04,650 --> 00:09:09,650 for this given threat of $3,333.33 218 218 00:09:09,810 --> 00:09:12,780 so it would make good business sense for me to mitigate this 219 219 00:09:12,780 --> 00:09:16,800 and solve the underlying risk by paying you $1,200 per year. 220 220 00:09:16,800 --> 00:09:18,327 You see how easy it is to make decisions when 221 221 00:09:18,327 --> 00:09:20,520 you have a quantitative risk calculation 222 222 00:09:20,520 --> 00:09:22,830 for the annual loss expectancy, and this is why 223 223 00:09:22,830 --> 00:09:25,260 most executives really love using quantitative 224 224 00:09:25,260 --> 00:09:28,260 risk analysis when they're making their business decisions. 225 225 00:09:28,260 --> 00:09:32,250 By having your metrics for SLE, ARO and ALE in hand 226 226 00:09:32,250 --> 00:09:33,690 you can have a more comprehensive view 227 227 00:09:33,690 --> 00:09:35,910 of the risk you're going to be taking into account as well 228 228 00:09:35,910 --> 00:09:37,830 as the likelihood of multiple events occurring 229 229 00:09:37,830 --> 00:09:40,500 over a given period of time, and then compare all that 230 230 00:09:40,500 --> 00:09:43,080 against the cost to remediate those risks. 231 231 00:09:43,080 --> 00:09:45,180 Sometimes though, you simply can't put a number 232 232 00:09:45,180 --> 00:09:46,440 on the risk you're looking at 233 233 00:09:46,440 --> 00:09:47,910 because you don't know all the costs 234 234 00:09:47,910 --> 00:09:50,730 or the potential liability behind a particular threat 235 235 00:09:50,730 --> 00:09:52,470 and when this happens, you're going to have to 236 236 00:09:52,470 --> 00:09:55,650 utilize a qualitative risk calculation instead. 237 237 00:09:55,650 --> 00:09:58,200 Now, a qualitative risk calculation is a method 238 238 00:09:58,200 --> 00:10:00,480 of risk assessment that uses subjective judgment 239 239 00:10:00,480 --> 00:10:03,090 and expert opinions to evaluate the likelihood 240 240 00:10:03,090 --> 00:10:05,310 and impact of potential threats. 241 241 00:10:05,310 --> 00:10:07,140 It doesn't rely on mathematics 242 242 00:10:07,140 --> 00:10:09,600 or statistical techniques to assign numerical values 243 243 00:10:09,600 --> 00:10:11,490 to the likelihood and impact of the threats 244 244 00:10:11,490 --> 00:10:14,190 like we did with a quantitative risk calculation. 245 245 00:10:14,190 --> 00:10:16,170 Instead, we're going to use a more flexible 246 246 00:10:16,170 --> 00:10:18,750 and subjective approach to assess our risk. 247 247 00:10:18,750 --> 00:10:20,730 In a qualitative risk calculation, 248 248 00:10:20,730 --> 00:10:23,220 experts in the field such as a cybersecurity analyst 249 249 00:10:23,220 --> 00:10:25,710 or cybersecurity engineer are going to use their knowledge 250 250 00:10:25,710 --> 00:10:27,750 and experience to evaluate the likelihood 251 251 00:10:27,750 --> 00:10:30,000 and impact of potential threats. 252 252 00:10:30,000 --> 00:10:31,110 They may then use a variety 253 253 00:10:31,110 --> 00:10:33,480 of methods to gather information about the risks 254 254 00:10:33,480 --> 00:10:37,020 such as brainstorming, interviews or focus group sessions. 255 255 00:10:37,020 --> 00:10:38,910 Now, once that information is gathered 256 256 00:10:38,910 --> 00:10:40,590 the experts will then use their judgment 257 257 00:10:40,590 --> 00:10:44,190 and expertise to assign a qualitative rating to that risk. 258 258 00:10:44,190 --> 00:10:46,920 This rating can be based on factors such as the likelihood 259 259 00:10:46,920 --> 00:10:49,080 and impact and can be described using terms 260 260 00:10:49,080 --> 00:10:51,330 such as high, medium, and low. 261 261 00:10:51,330 --> 00:10:53,532 Qualitative risk calculations are really useful 262 262 00:10:53,532 --> 00:10:56,190 because it allows organizations to evaluate risk 263 263 00:10:56,190 --> 00:10:58,530 even when there is limited data available. 264 264 00:10:58,530 --> 00:11:00,540 It can also provide valuable insight into new 265 265 00:11:00,540 --> 00:11:03,510 and emerging risks that may not have been seen before. 266 266 00:11:03,510 --> 00:11:04,860 Additionally, it can be useful 267 267 00:11:04,860 --> 00:11:07,170 for organizations with limited resources too 268 268 00:11:07,170 --> 00:11:09,300 because it generally requires less time and effort 269 269 00:11:09,300 --> 00:11:11,850 than doing a full mathematical based quantitative 270 270 00:11:11,850 --> 00:11:13,350 risk calculations. 271 271 00:11:13,350 --> 00:11:14,310 Now, most of the time 272 272 00:11:14,310 --> 00:11:16,590 if you're using a qualitative risk analysis 273 273 00:11:16,590 --> 00:11:18,330 you'll generate a simple three by three 274 274 00:11:18,330 --> 00:11:19,860 or four by four chart, 275 275 00:11:19,860 --> 00:11:22,110 and along one axis you'll plot the likelihood 276 276 00:11:22,110 --> 00:11:24,510 and along the other you'll plot the impact. 277 277 00:11:24,510 --> 00:11:26,880 Usually, if you're using a three by three matrix 278 278 00:11:26,880 --> 00:11:28,650 you'll use low, medium, and high. 279 279 00:11:28,650 --> 00:11:30,600 But if you're using a four by four matrix 280 280 00:11:30,600 --> 00:11:32,880 you'll use low, medium, high, and critical 281 281 00:11:32,880 --> 00:11:35,220 and your organization can use whatever terms they want 282 282 00:11:35,220 --> 00:11:37,980 but those are the most common ones that we see in the field. 283 283 00:11:37,980 --> 00:11:39,270 Now, let's say for example 284 284 00:11:39,270 --> 00:11:40,800 I had something that's a low impact 285 285 00:11:40,800 --> 00:11:42,300 and a low probability, 286 286 00:11:42,300 --> 00:11:45,960 overall we're going to rate this as a low and mark it is green. 287 287 00:11:45,960 --> 00:11:47,610 Now, if I have something with a high impact 288 288 00:11:47,610 --> 00:11:50,160 and a low probability, I would rate this overall 289 289 00:11:50,160 --> 00:11:52,650 as a medium risk and then mark it yellow. 290 290 00:11:52,650 --> 00:11:54,177 Now, if I have something that has a high impact 291 291 00:11:54,177 --> 00:11:56,460 and a high probability, I'm going to rate this 292 292 00:11:56,460 --> 00:11:59,280 as an overall high risk and mark it red. 293 293 00:11:59,280 --> 00:12:02,250 For this reason, a lot of people call these stoplight charts 294 294 00:12:02,250 --> 00:12:04,020 because the overall result we're looking it 295 295 00:12:04,020 --> 00:12:07,860 is either green, yellow, or red for each identified risk. 296 296 00:12:07,860 --> 00:12:09,720 Now, there are several reasons why qualitative 297 297 00:12:09,720 --> 00:12:11,820 risk calculations are sometimes preferred 298 298 00:12:11,820 --> 00:12:13,590 over quantitative risk calculations 299 299 00:12:13,590 --> 00:12:15,480 inside the cybersecurity industry. 300 300 00:12:15,480 --> 00:12:18,390 This includes reasons like complexity, unknowns, 301 301 00:12:18,390 --> 00:12:21,720 limited data, resource constraints, and communication. 302 302 00:12:21,720 --> 00:12:23,490 First, we have complexity. 303 303 00:12:23,490 --> 00:12:25,890 Cybersecurity threats are often highly complex 304 304 00:12:25,890 --> 00:12:28,590 and may be difficult to quantify using mathematical 305 305 00:12:28,590 --> 00:12:30,240 and statistical techniques. 306 306 00:12:30,240 --> 00:12:32,970 Because of this, qualitative risk calculations do allow 307 307 00:12:32,970 --> 00:12:33,930 for a more subjective 308 308 00:12:33,930 --> 00:12:37,320 and flexible approach to evaluating these types of risks. 309 309 00:12:37,320 --> 00:12:39,300 Now, second, we have unknowns. 310 310 00:12:39,300 --> 00:12:41,010 In cybersecurity there are a lot of threats 311 311 00:12:41,010 --> 00:12:43,080 that are constantly evolving and there's new threats 312 312 00:12:43,080 --> 00:12:45,810 in zero-days that are emerging all the time. 313 313 00:12:45,810 --> 00:12:48,660 Quantitative risk calculation relies on historical data 314 314 00:12:48,660 --> 00:12:49,710 which may not be available 315 315 00:12:49,710 --> 00:12:51,690 for these new and emerging threats. 316 316 00:12:51,690 --> 00:12:54,240 Therefore, qualitative risk calculations will allow 317 317 00:12:54,240 --> 00:12:55,860 for the inclusion of expert opinions 318 318 00:12:55,860 --> 00:12:58,500 and subjective judgment, which can provide valuable insight 319 319 00:12:58,500 --> 00:13:01,710 into the likelihood and impact of these new threats. 320 320 00:13:01,710 --> 00:13:03,930 Number three, we have limited data. 321 321 00:13:03,930 --> 00:13:06,360 In some cases, there may be limited data available 322 322 00:13:06,360 --> 00:13:09,000 to support a quantitative risk calculation. 323 323 00:13:09,000 --> 00:13:11,010 For example, there's a new threat that has never 324 324 00:13:11,010 --> 00:13:12,924 been seen before and there's no historical data 325 325 00:13:12,924 --> 00:13:14,940 for us to use for the analysis. 326 326 00:13:14,940 --> 00:13:15,773 Because of this, 327 327 00:13:15,773 --> 00:13:18,060 we can still use a qualitative risk calculation 328 328 00:13:18,060 --> 00:13:19,860 by using our experts and our knowledge 329 329 00:13:19,860 --> 00:13:23,070 and judgment instead of relying on that historical data. 330 330 00:13:23,070 --> 00:13:25,350 Fourth, resource constraints. 331 331 00:13:25,350 --> 00:13:28,050 Quantitative risk calculations can be really time consuming 332 332 00:13:28,050 --> 00:13:29,490 and resource intensive. 333 333 00:13:29,490 --> 00:13:31,230 Now, it's really easy with the formulas, 334 334 00:13:31,230 --> 00:13:33,900 but you have to get what is that exposure factor? 335 335 00:13:33,900 --> 00:13:35,460 What is that asset value? 336 336 00:13:35,460 --> 00:13:36,720 How many times did this thing happen 337 337 00:13:36,720 --> 00:13:38,970 over the last year or five years or 10 years? 338 338 00:13:38,970 --> 00:13:41,160 And all of that can take a lot of time. 339 339 00:13:41,160 --> 00:13:44,010 So by doing a qualitative risk calculation instead 340 340 00:13:44,010 --> 00:13:46,320 we can generally have a less complex method 341 341 00:13:46,320 --> 00:13:48,090 and it can be performed more quickly 342 342 00:13:48,090 --> 00:13:49,680 and it makes it very well suited 343 343 00:13:49,680 --> 00:13:52,230 for organizations with limited resources. 344 344 00:13:52,230 --> 00:13:54,450 And the fifth reason is communication. 345 345 00:13:54,450 --> 00:13:56,790 Qualitative risk calculations often use natural 346 346 00:13:56,790 --> 00:13:59,580 language instead of monetary values in math. 347 347 00:13:59,580 --> 00:14:02,190 This makes it a lot easier to understand for non-experts 348 348 00:14:02,190 --> 00:14:03,660 and this can help communicate the risk 349 349 00:14:03,660 --> 00:14:06,000 over to senior decision makers if they're not 350 350 00:14:06,000 --> 00:14:08,670 very technically minded or financially minded. 351 351 00:14:08,670 --> 00:14:09,690 Now, it is worth noting 352 352 00:14:09,690 --> 00:14:12,750 that qualitative risk calculations may not be as accurate 353 353 00:14:12,750 --> 00:14:15,600 as a quantitative risk calculation, and it's not 354 354 00:14:15,600 --> 00:14:19,320 recommended to solely rely on qualitative risk calculations. 355 355 00:14:19,320 --> 00:14:22,230 Most often I see a hybrid approach being used 356 356 00:14:22,230 --> 00:14:24,930 where both qualitative and quantitative risk calculations 357 357 00:14:24,930 --> 00:14:27,660 are being used together to provide a more comprehensive view 358 358 00:14:27,660 --> 00:14:30,330 of all the risks facing an organization. 359 359 00:14:30,330 --> 00:14:31,980 This semi quantitative method 360 360 00:14:31,980 --> 00:14:34,470 or what I like to call a hybrid risk analysis 361 361 00:14:34,470 --> 00:14:35,700 is really going to use a mixture 362 362 00:14:35,700 --> 00:14:37,650 of concrete values with the opinions 363 363 00:14:37,650 --> 00:14:41,160 and reasoning to measure the likelihood and impact of risk. 364 364 00:14:41,160 --> 00:14:43,170 Now, this method is used a lot to try 365 365 00:14:43,170 --> 00:14:45,450 to measure things that you can't measure necessarily 366 366 00:14:45,450 --> 00:14:48,150 very easily when you're dealing with dollars and cents. 367 367 00:14:48,150 --> 00:14:50,790 And so you can't do a full quantitative method, 368 368 00:14:50,790 --> 00:14:53,190 but you may have some data that you can use 369 369 00:14:53,190 --> 00:14:55,320 that can give you at least a baseline or a feeling 370 370 00:14:55,320 --> 00:14:57,810 about the dollars and cents that you're talking about. 371 371 00:14:57,810 --> 00:14:59,670 Let me give you a couple of examples. 372 372 00:14:59,670 --> 00:15:01,680 Let's say, for example, you want to calculate 373 373 00:15:01,680 --> 00:15:03,630 how much employee morale is worth 374 374 00:15:03,630 --> 00:15:05,610 in your company in dollars. 375 375 00:15:05,610 --> 00:15:07,655 Now, honestly, that's a really hard thing to answer 376 376 00:15:07,655 --> 00:15:11,100 because there really is no definitive way to quantify 377 377 00:15:11,100 --> 00:15:13,020 in dollars employee morale. 378 378 00:15:13,020 --> 00:15:14,550 But you may be able to start thinking 379 379 00:15:14,550 --> 00:15:16,710 of some things like linking employee morale 380 380 00:15:16,710 --> 00:15:17,880 to your productivity and saying, 381 381 00:15:17,880 --> 00:15:21,060 well if the morale is high, I see that people work harder 382 382 00:15:21,060 --> 00:15:23,910 and they work longer, and that makes our company more money. 383 383 00:15:23,910 --> 00:15:26,460 Or if they have low morale, they're working less 384 384 00:15:26,460 --> 00:15:27,690 and they don't do as much work for us 385 385 00:15:27,690 --> 00:15:29,580 and it costs us more money to get the same 386 386 00:15:29,580 --> 00:15:31,620 work, product out to our customers. 387 387 00:15:31,620 --> 00:15:33,570 And so you might be able to start putting a couple 388 388 00:15:33,570 --> 00:15:35,340 of dollars and cents numbers to it 389 389 00:15:35,340 --> 00:15:37,530 but it's not going to be really easy. 390 390 00:15:37,530 --> 00:15:39,360 It's not like I can definitively say, 391 391 00:15:39,360 --> 00:15:42,150 well if I have just one more point of employee morale 392 392 00:15:42,150 --> 00:15:44,790 that's going to save me a thousand dollars in labor costs. 393 393 00:15:44,790 --> 00:15:46,350 So employee morale in dollars 394 394 00:15:46,350 --> 00:15:48,900 and cents is not going to be really easy for us to calculate 395 395 00:15:48,900 --> 00:15:50,280 and instead we're going to have to use more 396 396 00:15:50,280 --> 00:15:53,700 of this hybrid or semi quantitative method to calculate it. 397 397 00:15:53,700 --> 00:15:55,320 Now, another good example might be 398 398 00:15:55,320 --> 00:15:56,880 your company's reputation. 399 399 00:15:56,880 --> 00:15:59,910 How much is your company's reputation worth in dollars? 400 400 00:15:59,910 --> 00:16:01,530 Again, this is a hard one 401 401 00:16:01,530 --> 00:16:03,510 because it takes years to build a reputation 402 402 00:16:03,510 --> 00:16:05,250 and only moments to destroy it. 403 403 00:16:05,250 --> 00:16:07,260 I'm sure if I pressed you really hard 404 404 00:16:07,260 --> 00:16:09,000 you could assign a dollar figure to it, 405 405 00:16:09,000 --> 00:16:11,460 but there'd be some kind of squishiness to it 406 406 00:16:11,460 --> 00:16:14,730 because it's really a best guess and not an exact science. 407 407 00:16:14,730 --> 00:16:16,350 You might look at some historical values 408 408 00:16:16,350 --> 00:16:18,450 like another company who suffered a data breach 409 409 00:16:18,450 --> 00:16:20,340 and how their stock prices reacted to it 410 410 00:16:20,340 --> 00:16:23,700 or if their sales went down afterwards or other factors 411 411 00:16:23,700 --> 00:16:24,690 and that way you can get an idea 412 412 00:16:24,690 --> 00:16:26,790 of how much their reputation was worth. 413 413 00:16:26,790 --> 00:16:28,800 But to identify exactly a number 414 414 00:16:28,800 --> 00:16:31,800 for your own company is still going to be really hard to do 415 415 00:16:31,800 --> 00:16:33,630 before an incident occurs. 416 416 00:16:33,630 --> 00:16:36,060 It really is a lot easier to measure the aftermath 417 417 00:16:36,060 --> 00:16:38,490 of a data breach because you can add up all your costs 418 418 00:16:38,490 --> 00:16:41,340 and operational losses to calculate an exact figure 419 419 00:16:41,340 --> 00:16:44,670 and that could represent some of this reputational harm. 420 420 00:16:44,670 --> 00:16:46,710 Let me give you one final example to show you how 421 421 00:16:46,710 --> 00:16:48,270 difficult this can be. 422 422 00:16:48,270 --> 00:16:49,530 What if I asked you how much 423 423 00:16:49,530 --> 00:16:51,240 of a cost if your network was down 424 424 00:16:51,240 --> 00:16:55,230 between 2:00 AM and 4:00 AM on July 22nd next year? 425 425 00:16:55,230 --> 00:16:57,270 Now, this is a really specific question 426 426 00:16:57,270 --> 00:16:59,670 and you could probably go back and pull the historical data 427 427 00:16:59,670 --> 00:17:02,823 from July 22nd for the last 10 years and maybe do some kind 428 428 00:17:02,823 --> 00:17:05,580 of quantitative analysis where you can start looking 429 429 00:17:05,580 --> 00:17:06,450 at all those numbers 430 430 00:17:06,450 --> 00:17:08,321 and try to get something that looks right 431 431 00:17:08,321 --> 00:17:10,470 but it's probably a lot easier 432 432 00:17:10,470 --> 00:17:12,660 for you to look at it in a qualitative manner 433 433 00:17:12,660 --> 00:17:14,370 and start thinking about it like this. 434 434 00:17:14,370 --> 00:17:18,180 Hmm, my company only works from 9:00 AM to 5:00 PM each day. 435 435 00:17:18,180 --> 00:17:20,780 So if we have a network outage between 2:00 AM 436 436 00:17:20,780 --> 00:17:24,120 and 4:00 AM it's probably not a big deal for this company. 437 437 00:17:24,120 --> 00:17:27,030 But if we had one between 2:00 PM and 4:00 PM 438 438 00:17:27,030 --> 00:17:28,860 that would actually be a bigger deal for us 439 439 00:17:28,860 --> 00:17:30,510 because that's a timeframe we're expected 440 440 00:17:30,510 --> 00:17:31,920 to service our customers. 441 441 00:17:31,920 --> 00:17:34,950 So I can say that between 2:00 AM and 4:00 AM 442 442 00:17:34,950 --> 00:17:36,600 this would have a low impact 443 443 00:17:36,600 --> 00:17:38,880 and therefore overall it might be a low event 444 444 00:17:38,880 --> 00:17:41,070 for us or maybe possibly a medium event 445 445 00:17:41,070 --> 00:17:43,770 if it had a really high probability of occurring. 446 446 00:17:43,770 --> 00:17:44,700 So as you can see 447 447 00:17:44,700 --> 00:17:47,130 there are benefits to using purely quantitative methods 448 448 00:17:47,130 --> 00:17:49,320 'cause you get that dollars and cents answer. 449 449 00:17:49,320 --> 00:17:50,550 And there's also benefits in using 450 450 00:17:50,550 --> 00:17:53,130 a purely qualitative method based on reasoning 451 451 00:17:53,130 --> 00:17:54,690 expertise and judgment. 452 452 00:17:54,690 --> 00:17:57,540 Or you can use a hybrid of the two depending on the types 453 453 00:17:57,540 --> 00:17:59,970 of threats you're trying to evaluate and the amount of data 454 454 00:17:59,970 --> 00:18:02,310 or information you have at your disposal and the amount 455 455 00:18:02,310 --> 00:18:04,860 of time you have available to make that decision. 456 456 00:18:04,860 --> 00:18:06,810 It really isn't a this or that. 457 457 00:18:06,810 --> 00:18:09,300 Sometimes it's this, that and the other thing. 458 458 00:18:09,300 --> 00:18:10,590 And we can use all of these 459 459 00:18:10,590 --> 00:18:13,293 to better understand our risk in our organizations.