1 1 00:00:00,360 --> 00:00:02,820 Risk Prioritization: 2 2 00:00:02,820 --> 00:00:05,070 now we're going to talk about risk prioritization 3 3 00:00:05,070 --> 00:00:07,470 in this lesson because it's important to remember 4 4 00:00:07,470 --> 00:00:10,230 that not all risks are created equal. 5 5 00:00:10,230 --> 00:00:11,632 Once we determine what a risk is 6 6 00:00:11,632 --> 00:00:15,270 we have to determine what we're going to do about that risk. 7 7 00:00:15,270 --> 00:00:16,590 And this brings up the question 8 8 00:00:16,590 --> 00:00:19,470 of what should be done with a particular risk. 9 9 00:00:19,470 --> 00:00:21,330 Well, there's lots of things you can do with it. 10 10 00:00:21,330 --> 00:00:23,250 In fact, there are four main areas. 11 11 00:00:23,250 --> 00:00:26,100 You can mitigate that risk using risk mitigation. 12 12 00:00:26,100 --> 00:00:28,800 You can avoid that risk using risk avoidance. 13 13 00:00:28,800 --> 00:00:31,620 You can transfer that risk using risk transference 14 14 00:00:31,620 --> 00:00:34,650 and you can accept that risk using risk acceptance. 15 15 00:00:34,650 --> 00:00:36,930 We're going to talk about each of these four in this lesson 16 16 00:00:36,930 --> 00:00:40,470 but before we do, we have to talk about risk appetite. 17 17 00:00:40,470 --> 00:00:42,150 Now, you may or may not be familiar 18 18 00:00:42,150 --> 00:00:43,860 with the term risk appetite, 19 19 00:00:43,860 --> 00:00:46,500 but essentially what it means is how much risk 20 20 00:00:46,500 --> 00:00:49,170 is your organization willing to accept. 21 21 00:00:49,170 --> 00:00:52,230 For example, if you're a big multi-billion dollar company 22 22 00:00:52,230 --> 00:00:55,410 like Amazon, you might have a higher risk appetite 23 23 00:00:55,410 --> 00:00:57,630 where if there's a risk that is a million dollars, 24 24 00:00:57,630 --> 00:01:00,000 you'll take that risk because you can afford it. 25 25 00:01:00,000 --> 00:01:01,320 But if you're a small company like me, 26 26 00:01:01,320 --> 00:01:03,360 we can't afford to take a million dollar risk 27 27 00:01:03,360 --> 00:01:05,070 that would bankrupt our company. 28 28 00:01:05,070 --> 00:01:07,304 And so you have to have an idea 29 29 00:01:07,304 --> 00:01:09,390 in your organization what is your risk appetite. 30 30 00:01:09,390 --> 00:01:12,360 Some organizations are very heavy on their risk appetite. 31 31 00:01:12,360 --> 00:01:14,280 They'll take on a lot of monetary risk 32 32 00:01:14,280 --> 00:01:16,950 or a lot more dangerous risk. 33 33 00:01:16,950 --> 00:01:19,380 If you're somebody who has a very low risk appetite 34 34 00:01:19,380 --> 00:01:20,850 you're going to try to shine all risk 35 35 00:01:20,850 --> 00:01:23,850 and try to avoid it and mitigate it as much as possible. 36 36 00:01:23,850 --> 00:01:24,683 Knowing this, 37 37 00:01:24,683 --> 00:01:26,460 and knowing what your organizational culture is, 38 38 00:01:26,460 --> 00:01:28,650 will help you determine which of these four things 39 39 00:01:28,650 --> 00:01:30,360 you are going to do when you deal with risk 40 40 00:01:30,360 --> 00:01:32,400 and you're probably going to do some of each of them. 41 41 00:01:32,400 --> 00:01:34,620 Now, let's go ahead and talk about each of these four. 42 42 00:01:34,620 --> 00:01:36,840 The first one is risk mitigation, 43 43 00:01:36,840 --> 00:01:39,434 now, risk mitigation is a risk response that reduces 44 44 00:01:39,434 --> 00:01:43,140 a risk to fit within an organization's risk appetite. 45 45 00:01:43,140 --> 00:01:45,272 And so you can see why I thought it was important 46 46 00:01:45,272 --> 00:01:46,170 to talk about risk appetite. 47 47 00:01:46,170 --> 00:01:47,610 If you have a high risk appetite, 48 48 00:01:47,610 --> 00:01:49,410 you might need very little mitigation. 49 49 00:01:49,410 --> 00:01:50,790 If you have a low risk appetite 50 50 00:01:50,790 --> 00:01:53,190 you might need a lot of mitigation. 51 51 00:01:53,190 --> 00:01:55,260 Now, when we talk about risk mitigation, 52 52 00:01:55,260 --> 00:01:57,570 this also brings up the idea of risk deterrence 53 53 00:01:57,570 --> 00:01:59,070 or risk reduction. 54 54 00:01:59,070 --> 00:02:00,480 This refers to controls that can 55 55 00:02:00,480 --> 00:02:03,960 either make a risk incident less likely or less costly. 56 56 00:02:03,960 --> 00:02:05,760 So, for example, if you're worried 57 57 00:02:05,760 --> 00:02:08,070 about getting into an accident in your car, 58 58 00:02:08,070 --> 00:02:10,140 one of the risk mitigations you can do if you're worried 59 59 00:02:10,140 --> 00:02:11,700 about hurting yourself in an accident 60 60 00:02:11,700 --> 00:02:15,120 is put on your seatbelt or drive a car with airbags. 61 61 00:02:15,120 --> 00:02:17,520 Both of those are not going to stop you from getting 62 62 00:02:17,520 --> 00:02:19,290 into that accident necessarily, 63 63 00:02:19,290 --> 00:02:21,810 but they will reduce the harm that would happen 64 64 00:02:21,810 --> 00:02:23,130 if you were in an accident 65 65 00:02:23,130 --> 00:02:25,530 because you're mitigating that risk. 66 66 00:02:25,530 --> 00:02:27,060 Now, another thing we might look at 67 67 00:02:27,060 --> 00:02:30,030 in the software world is patching our software. 68 68 00:02:30,030 --> 00:02:31,770 We do vulnerability assessments. 69 69 00:02:31,770 --> 00:02:33,180 We scan our network to find out 70 70 00:02:33,180 --> 00:02:35,190 what systems have not been patched. 71 71 00:02:35,190 --> 00:02:37,950 We find those systems and we apply the patch to them; 72 72 00:02:37,950 --> 00:02:39,630 that is going to reduce our risk. 73 73 00:02:39,630 --> 00:02:42,150 Does that protect our systems 100%? 74 74 00:02:42,150 --> 00:02:43,500 No, of course not, 75 75 00:02:43,500 --> 00:02:45,300 there's still risk to that system, 76 76 00:02:45,300 --> 00:02:46,620 but you are getting a lot 77 77 00:02:46,620 --> 00:02:48,540 of those easy mitigation out of the way 78 78 00:02:48,540 --> 00:02:51,600 by patching those systems against known vulnerabilities. 79 79 00:02:51,600 --> 00:02:53,910 That is the idea of risk mitigation. 80 80 00:02:53,910 --> 00:02:55,740 Now, the second category we have is known 81 81 00:02:55,740 --> 00:02:57,390 as risk avoidance. 82 82 00:02:57,390 --> 00:03:00,360 This is a risk response that involves ceasing an activity 83 83 00:03:00,360 --> 00:03:01,830 that presents risk. 84 84 00:03:01,830 --> 00:03:03,630 So I'll give you a great example of this. 85 85 00:03:03,630 --> 00:03:06,090 My wife doesn't like to fly. 86 86 00:03:06,090 --> 00:03:09,510 In fact, she is petrified of small airplanes. 87 87 00:03:09,510 --> 00:03:11,520 She is afraid that if she gets into a Cessna 88 88 00:03:11,520 --> 00:03:14,400 it's going to go up and crash down into a lake. 89 89 00:03:14,400 --> 00:03:16,020 Now, her fear of these small planes 90 90 00:03:16,020 --> 00:03:17,310 is not unfounded though, 91 91 00:03:17,310 --> 00:03:18,870 she actually had a friend who died 92 92 00:03:18,870 --> 00:03:20,100 when she was very young 93 93 00:03:20,100 --> 00:03:21,570 because their family died 94 94 00:03:21,570 --> 00:03:23,130 in one of these small plane crashes. 95 95 00:03:23,130 --> 00:03:24,060 And because of that. 96 96 00:03:24,060 --> 00:03:27,090 my wife refuses to go onto a small plane. 97 97 00:03:27,090 --> 00:03:28,860 Now, I've been able to get her on larger planes. 98 98 00:03:28,860 --> 00:03:30,180 She'll go on a commercial plane 99 99 00:03:30,180 --> 00:03:31,710 'cause she feels they're a little bit safer, 100 100 00:03:31,710 --> 00:03:33,240 but she still doesn't like them. 101 101 00:03:33,240 --> 00:03:35,760 But again, she is not going to go on a small plane. 102 102 00:03:35,760 --> 00:03:37,710 It's something she's decided in her life, 103 103 00:03:37,710 --> 00:03:38,970 it's not worth the risk. 104 104 00:03:38,970 --> 00:03:42,060 So she has avoided going on small planes her entire life 105 105 00:03:42,060 --> 00:03:43,530 and she refuses to go on 'em. 106 106 00:03:43,530 --> 00:03:44,700 She'll go on a jumbo jet, 107 107 00:03:44,700 --> 00:03:46,260 but she will not go on one of those Cessnas. 108 108 00:03:46,260 --> 00:03:48,180 And that is the idea of risk avoidance: 109 109 00:03:48,180 --> 00:03:50,370 this risk to her is just so bad 110 110 00:03:50,370 --> 00:03:52,290 that she is not willing to take the chance at all 111 111 00:03:52,290 --> 00:03:53,700 and that is risk avoidance. 112 112 00:03:53,700 --> 00:03:54,533 Now, unfortunately 113 113 00:03:54,533 --> 00:03:57,030 risk avoidance is not really a valid solution 114 114 00:03:57,030 --> 00:04:00,180 most of the time because you simply can't avoid all risks. 115 115 00:04:00,180 --> 00:04:02,010 There are some risks you can avoid, 116 116 00:04:02,010 --> 00:04:04,650 but if you wanted to avoid all risk across everything 117 117 00:04:04,650 --> 00:04:05,850 that's just not possible. 118 118 00:04:05,850 --> 00:04:06,990 So we're going to have to combine some 119 119 00:04:06,990 --> 00:04:09,000 of these strategies as we go. 120 120 00:04:09,000 --> 00:04:11,790 The next one we're going to talk about is risk transference. 121 121 00:04:11,790 --> 00:04:13,170 We talk about risk transference. 122 122 00:04:13,170 --> 00:04:15,270 This is a risk response that involves moving 123 123 00:04:15,270 --> 00:04:19,080 or sharing the responsibility of risk to another entity. 124 124 00:04:19,080 --> 00:04:20,550 Now what does this really mean? 125 125 00:04:20,550 --> 00:04:22,650 Well, let me give you a really easy example. 126 126 00:04:22,650 --> 00:04:24,660 I used the car example earlier. 127 127 00:04:24,660 --> 00:04:26,970 If you're worried about getting into a car accident, 128 128 00:04:26,970 --> 00:04:29,310 you can mitigate the risk by putting on your seatbelt 129 129 00:04:29,310 --> 00:04:33,150 to help yourself not get hurt as badly, that's a mitigation. 130 130 00:04:33,150 --> 00:04:35,940 But if I wanted to transfer the risk of this car accident, 131 131 00:04:35,940 --> 00:04:38,400 what are one of the things that we all have for our cars? 132 132 00:04:38,400 --> 00:04:39,930 We have car insurance, right. 133 133 00:04:39,930 --> 00:04:41,370 So if I get into a car accident 134 134 00:04:41,370 --> 00:04:43,290 and I smash up the front of my car, 135 135 00:04:43,290 --> 00:04:45,840 I call up my insurance company they write me a check 136 136 00:04:45,840 --> 00:04:48,390 and I get a new car or I get my car fixed. 137 137 00:04:48,390 --> 00:04:51,420 I transferred the financial loss of that vehicle 138 138 00:04:51,420 --> 00:04:54,420 to the insurance company by paying them a monthly premium 139 139 00:04:54,420 --> 00:04:55,980 they will then cover that risk for me. 140 140 00:04:55,980 --> 00:04:58,230 I transferred it and gave it to this other entity, 141 141 00:04:58,230 --> 00:05:00,780 this third party and that's the idea. 142 142 00:05:00,780 --> 00:05:02,640 Now, how does this apply in the cyber world? 143 143 00:05:02,640 --> 00:05:04,710 Well, there's lots of ways we can do this. 144 144 00:05:04,710 --> 00:05:07,710 One of the ways is we can actually use cyber insurance. 145 145 00:05:07,710 --> 00:05:09,570 There are cyber insurance policies out there 146 146 00:05:09,570 --> 00:05:11,160 against data breaches now. 147 147 00:05:11,160 --> 00:05:13,080 Your company can pay a policy 148 148 00:05:13,080 --> 00:05:14,640 to a cyber insurance company 149 149 00:05:14,640 --> 00:05:17,400 and if you are hacked they will pay for the response 150 150 00:05:17,400 --> 00:05:18,510 and they'll pay for the cleanup 151 151 00:05:18,510 --> 00:05:20,910 and they'll pay for any damages to your customers; 152 152 00:05:20,910 --> 00:05:22,890 that is one way to transfer that liability 153 153 00:05:22,890 --> 00:05:25,980 over to this third party using risk transference. 154 154 00:05:25,980 --> 00:05:28,020 Now, another way you can do risk transference 155 155 00:05:28,020 --> 00:05:30,240 is you can actually outsource a service. 156 156 00:05:30,240 --> 00:05:33,270 Now, for example, I don't host my own web servers anymore. 157 157 00:05:33,270 --> 00:05:36,030 We pay a third party and that's their job. 158 158 00:05:36,030 --> 00:05:37,710 They host our web servers for us. 159 159 00:05:37,710 --> 00:05:40,950 They host it in a place that has 24/7 power and electricity 160 160 00:05:40,950 --> 00:05:43,350 and good connectivity and all of those things 161 161 00:05:43,350 --> 00:05:45,060 and they make sure they actually patch our servers 162 162 00:05:45,060 --> 00:05:48,030 against vulnerabilities and provide us those protections. 163 163 00:05:48,030 --> 00:05:49,320 Now, could we do it ourself? 164 164 00:05:49,320 --> 00:05:51,870 Yes, but again, we're a training company now. 165 165 00:05:51,870 --> 00:05:53,880 We're not focused on running these systems anymore. 166 166 00:05:53,880 --> 00:05:55,290 I've done that in my career. 167 167 00:05:55,290 --> 00:05:56,427 I don't want to have to have that responsibility 168 168 00:05:56,427 --> 00:05:58,890 and that extra baggage inside our company. 169 169 00:05:58,890 --> 00:06:01,350 We instead want to focus on providing you the best training, 170 170 00:06:01,350 --> 00:06:03,180 not on providing the best servers. 171 171 00:06:03,180 --> 00:06:04,620 We can outsource somebody else 172 172 00:06:04,620 --> 00:06:06,210 to provide those best servers for us. 173 173 00:06:06,210 --> 00:06:07,043 And that's the idea 174 174 00:06:07,043 --> 00:06:09,210 of risk transference because they're responsible 175 175 00:06:09,210 --> 00:06:11,880 for the maintenance, the upkeep, the patching, the software; 176 176 00:06:11,880 --> 00:06:14,790 all of that has been transferred to that organization. 177 177 00:06:14,790 --> 00:06:16,980 Now, I can't transfer away the responsibility 178 178 00:06:16,980 --> 00:06:20,250 or the reputational damage to your organization. 179 179 00:06:20,250 --> 00:06:21,300 As I was saying, 180 180 00:06:21,300 --> 00:06:23,760 I transfer away my web service to a third party company, 181 181 00:06:23,760 --> 00:06:25,230 but if we have a data breach, 182 182 00:06:25,230 --> 00:06:26,160 it's still our company 183 183 00:06:26,160 --> 00:06:27,720 that's going to have a tarnished reputation 184 184 00:06:27,720 --> 00:06:29,700 and we're still going to take the heat for that. 185 185 00:06:29,700 --> 00:06:31,950 Now, they're going to pay for all the data breach 186 186 00:06:31,950 --> 00:06:33,270 and they're going to pay for all the cleanup 187 187 00:06:33,270 --> 00:06:35,460 and the response because that's part of their contract. 188 188 00:06:35,460 --> 00:06:37,860 But my organization still is going to look bad. 189 189 00:06:37,860 --> 00:06:40,770 I can't simply say, Hey, XYZ company is at fault. 190 190 00:06:40,770 --> 00:06:42,240 You aren't going to believe that as a student, 191 191 00:06:42,240 --> 00:06:44,430 you're still looking at me because you are my customer. 192 192 00:06:44,430 --> 00:06:45,690 You weren't their customer 193 193 00:06:45,690 --> 00:06:47,321 and so that's one of those risks 194 194 00:06:47,321 --> 00:06:48,154 that you have to think about 195 195 00:06:48,154 --> 00:06:48,987 when you're doing risk transference. 196 196 00:06:48,987 --> 00:06:52,800 Now, the final one we want to talk about is risk acceptance. 197 197 00:06:52,800 --> 00:06:55,440 Now, with risk acceptance, this is a risk response 198 198 00:06:55,440 --> 00:06:57,270 that involves determining what a risk is 199 199 00:06:57,270 --> 00:06:59,670 within the organization's risk appetite 200 200 00:06:59,670 --> 00:07:02,568 and there's going to be no other countermeasures other 201 201 00:07:02,568 --> 00:07:03,900 than monitoring will be needed here. 202 202 00:07:03,900 --> 00:07:04,800 Now, what we're talking about 203 203 00:07:04,800 --> 00:07:07,620 with risk acceptance is we simply say, I know this is risky. 204 204 00:07:07,620 --> 00:07:08,670 I know this is dangerous, 205 205 00:07:08,670 --> 00:07:11,340 but it's a small enough danger that I'm going to take it. 206 206 00:07:11,340 --> 00:07:14,070 For instance, that if you get on a commercial plane, 207 207 00:07:14,070 --> 00:07:15,330 it could crash, 208 208 00:07:15,330 --> 00:07:17,160 but it's a small enough risk that most 209 209 00:07:17,160 --> 00:07:20,070 of us will get on a commercial plane and take that chance. 210 210 00:07:20,070 --> 00:07:21,270 Just like there's a risk of you getting 211 211 00:07:21,270 --> 00:07:23,070 into a car accident when you go to work, 212 212 00:07:23,070 --> 00:07:24,750 you might take that risk. 213 213 00:07:24,750 --> 00:07:27,750 Now, you might also accept what's left over in the risk. 214 214 00:07:27,750 --> 00:07:29,273 So if I have my car, 215 215 00:07:29,273 --> 00:07:32,190 I already have car insurance to cover the cost. 216 216 00:07:32,190 --> 00:07:34,260 I already am wearing my seatbelt to mitigate that. 217 217 00:07:34,260 --> 00:07:35,130 I have transference. 218 218 00:07:35,130 --> 00:07:37,860 I have mitigation, but I could still get into an accident 219 219 00:07:37,860 --> 00:07:39,240 and I could still get hurt, 220 220 00:07:39,240 --> 00:07:41,310 but I'm accepting that risk that's left 221 221 00:07:41,310 --> 00:07:44,280 after I've transferred and mitigated the big areas of risk, 222 222 00:07:44,280 --> 00:07:46,320 which was the cost of replacing my car 223 223 00:07:46,320 --> 00:07:48,417 or the ability to actually get someplace. 224 224 00:07:48,417 --> 00:07:50,910 And I need to do that so I have worn my seatbelt; 225 225 00:07:50,910 --> 00:07:51,750 I have an airbags. 226 226 00:07:51,750 --> 00:07:52,800 I have a safe car 227 227 00:07:52,800 --> 00:07:55,050 and I'm going to go ahead and accept the rest of that risk. 228 228 00:07:55,050 --> 00:07:57,480 Now, let's talk about the exam for just a moment here. 229 229 00:07:57,480 --> 00:07:59,220 I want to give you a few quick tips 230 230 00:07:59,220 --> 00:08:01,890 in regards to choosing the best risk response. 231 231 00:08:01,890 --> 00:08:04,980 Now, the most common one you're going to see is mitigation. 232 232 00:08:04,980 --> 00:08:07,560 Mitigation involves adding controls. 233 233 00:08:07,560 --> 00:08:09,000 So whenever you think about mitigation, 234 234 00:08:09,000 --> 00:08:11,160 I want you to think about adding controls. 235 235 00:08:11,160 --> 00:08:12,780 Then we want to talk about avoidance. 236 236 00:08:12,780 --> 00:08:14,400 Avoidance is our least common one 237 237 00:08:14,400 --> 00:08:16,470 and it involves changing your course of action 238 238 00:08:16,470 --> 00:08:17,970 or the systems of use. 239 239 00:08:17,970 --> 00:08:19,170 So when I think about this 240 240 00:08:19,170 --> 00:08:21,330 I like to think about changing plans. 241 241 00:08:21,330 --> 00:08:23,700 I planned on doing this, but I'm going to avoid it 242 242 00:08:23,700 --> 00:08:26,160 and I'm going to do something else instead. 243 243 00:08:26,160 --> 00:08:28,320 The next one we want to talk about is transference. 244 244 00:08:28,320 --> 00:08:31,680 Transference is all about moving the risk to a third party. 245 245 00:08:31,680 --> 00:08:32,520 On the exam, 246 246 00:08:32,520 --> 00:08:34,890 this is almost always going to involve some kind 247 247 00:08:34,890 --> 00:08:36,960 of insurance policy being purchased. 248 248 00:08:36,960 --> 00:08:40,020 For example, my company offers a form of risk transference 249 249 00:08:40,020 --> 00:08:43,020 for our students who are afraid they might fail the exam. 250 250 00:08:43,020 --> 00:08:46,230 If you go and buy your exam voucher from diontraining.com, 251 251 00:08:46,230 --> 00:08:47,970 you can purchase an add-on product that we have 252 252 00:08:47,970 --> 00:08:49,110 for an extra fee. 253 253 00:08:49,110 --> 00:08:51,000 And this gives you a new exam voucher, 254 254 00:08:51,000 --> 00:08:52,770 if you fail the first time. 255 255 00:08:52,770 --> 00:08:54,420 Now, normally when you go to Comp TIA 256 256 00:08:54,420 --> 00:08:56,370 and you buy your exam voucher, you'll pay full price 257 257 00:08:56,370 --> 00:08:58,440 and you'll pay about $350. 258 258 00:08:58,440 --> 00:08:59,520 Once you buy that voucher, 259 259 00:08:59,520 --> 00:09:00,900 if you take the exam and fail it, 260 260 00:09:00,900 --> 00:09:02,340 you have to go buy another voucher 261 261 00:09:02,340 --> 00:09:04,230 before you can retake the exam. 262 262 00:09:04,230 --> 00:09:06,300 Well, with our add-on product, you buy the voucher 263 263 00:09:06,300 --> 00:09:08,460 from us and we charge you a little bit extra 264 264 00:09:08,460 --> 00:09:10,920 for this extra option we call Take2. 265 265 00:09:10,920 --> 00:09:13,290 This allows you to pay this upfront feed us that's less 266 266 00:09:13,290 --> 00:09:15,420 than the cost of a new exam voucher. 267 267 00:09:15,420 --> 00:09:16,650 We take on the risk for you 268 268 00:09:16,650 --> 00:09:17,730 that if you fail the exam, 269 269 00:09:17,730 --> 00:09:20,790 we will buy you a new voucher for the full $350. 270 270 00:09:20,790 --> 00:09:22,920 and so it saves you money if you fail. 271 271 00:09:22,920 --> 00:09:25,140 But if you pass the first time you paid us 272 272 00:09:25,140 --> 00:09:26,880 that extra money really for nothing, right, 273 273 00:09:26,880 --> 00:09:28,290 because you didn't crash your car. 274 274 00:09:28,290 --> 00:09:29,640 I think about it like car insurance, 275 275 00:09:29,640 --> 00:09:32,460 you pay for car insurance hoping you never crash your car. 276 276 00:09:32,460 --> 00:09:35,370 It's the same thing here with this failed exam transference. 277 277 00:09:35,370 --> 00:09:37,170 You're hoping that you're not going to have to use it, 278 278 00:09:37,170 --> 00:09:39,660 but if you do, it's a great thing to have 279 279 00:09:39,660 --> 00:09:40,950 and so that's the idea here. 280 280 00:09:40,950 --> 00:09:42,180 It's a form of transference 281 281 00:09:42,180 --> 00:09:44,220 or insurance against you failing your exam. 282 282 00:09:44,220 --> 00:09:46,170 And so you're buying that extra peace of mind 283 283 00:09:46,170 --> 00:09:47,700 to know that you're going to have a second attempt 284 284 00:09:47,700 --> 00:09:48,810 if you need it. 285 285 00:09:48,810 --> 00:09:50,850 And then finally we have acceptance; 286 286 00:09:50,850 --> 00:09:53,130 acceptance is when you accept the risk. 287 287 00:09:53,130 --> 00:09:56,043 It has to be less than the organizational's risk appetite. 288 288 00:09:56,886 --> 00:09:58,200 Here normally we're going to accept a risk 289 289 00:09:58,200 --> 00:10:00,600 for small things that are unlikely to happen. 290 290 00:10:00,600 --> 00:10:02,520 For example, I accept the risk 291 291 00:10:02,520 --> 00:10:05,880 then alien invasion may occur and put me out of business. 292 292 00:10:05,880 --> 00:10:08,040 I also believe that it's going to be extremely unlikely 293 293 00:10:08,040 --> 00:10:09,720 that an alien invasion's going to happen. 294 294 00:10:09,720 --> 00:10:11,709 So I haven't put forth any resources, thought 295 295 00:10:11,709 --> 00:10:15,210 or planning into preparing for an alien invasion. 296 296 00:10:15,210 --> 00:10:16,890 Similarly, I haven't planned for the end 297 297 00:10:16,890 --> 00:10:18,750 of the world or a zombie apocalypse. 298 298 00:10:18,750 --> 00:10:20,910 I just don't think those things are big deals. 299 299 00:10:20,910 --> 00:10:22,470 On the other hand, as I said, 300 300 00:10:22,470 --> 00:10:25,020 I spent a good deal of money trying to add controls 301 301 00:10:25,020 --> 00:10:28,290 to protect our business from power outages, from flooding, 302 302 00:10:28,290 --> 00:10:30,540 from hurricanes, from earthquakes. 303 303 00:10:30,540 --> 00:10:31,830 Those are all things that we're subject 304 304 00:10:31,830 --> 00:10:33,390 to by living in Puerto Rico. 305 305 00:10:33,390 --> 00:10:34,620 And so we have to have protections 306 306 00:10:34,620 --> 00:10:35,880 in place for those things 307 307 00:10:35,880 --> 00:10:37,770 and those are things we are going to add controls to. 308 308 00:10:37,770 --> 00:10:39,690 We're not going to accept those and just say, 309 309 00:10:39,690 --> 00:10:40,800 oh, well if a hurricane comes 310 310 00:10:40,800 --> 00:10:42,850 and we're out of power for three months, 311 311 00:10:42,850 --> 00:10:43,980 we'll just be out of offline for three months, 312 312 00:10:43,980 --> 00:10:45,270 that wouldn't be good for our customers 313 313 00:10:45,270 --> 00:10:46,650 so we're not going to do that. 314 314 00:10:46,650 --> 00:10:47,700 So this is the idea here. 315 315 00:10:47,700 --> 00:10:49,950 So what I want you to remember is on the exam, 316 316 00:10:49,950 --> 00:10:53,250 this little cheat sheet you see here, mitigation controls, 317 317 00:10:53,250 --> 00:10:56,940 avoidance, changing plans, transference insurance 318 318 00:10:56,940 --> 00:10:59,730 and acceptance is for low risk activities. 319 319 00:10:59,730 --> 00:11:01,770 Alright, now with all that mine, 320 320 00:11:01,770 --> 00:11:04,860 let's start talking about security control prioritization 321 321 00:11:04,860 --> 00:11:06,720 because there are a million controls out there 322 322 00:11:06,720 --> 00:11:09,540 and you have to decide which ones you're going to use. 323 323 00:11:09,540 --> 00:11:11,730 Now, there are three main areas we're going to talk about 324 324 00:11:11,730 --> 00:11:13,290 with security controls. 325 325 00:11:13,290 --> 00:11:16,380 First, we have to talk about whether the control is required 326 326 00:11:16,380 --> 00:11:19,530 by a framework, a best practice or regulation. 327 327 00:11:19,530 --> 00:11:21,000 If it's required by one of those three, 328 328 00:11:21,000 --> 00:11:22,590 it's going to have a higher priority for us 329 329 00:11:22,590 --> 00:11:25,410 and we're going to do it, especially if it's a regulation. 330 330 00:11:25,410 --> 00:11:27,000 Regulation means law; 331 331 00:11:27,000 --> 00:11:28,230 it means you can be fined 332 332 00:11:28,230 --> 00:11:30,450 or put out of business if you don't do it. 333 333 00:11:30,450 --> 00:11:33,360 So you need to make sure you're following those things. 334 334 00:11:33,360 --> 00:11:35,910 Second, we need to think about the cost of the control. 335 335 00:11:35,910 --> 00:11:37,530 This is going to require us to think both 336 336 00:11:37,530 --> 00:11:39,930 in what it costs us to get the control initially, 337 337 00:11:39,930 --> 00:11:41,160 as well as the ongoing maintenance 338 338 00:11:41,160 --> 00:11:42,780 and support for that control. 339 339 00:11:42,780 --> 00:11:45,270 If this control is going to cost me a million dollars a year, 340 340 00:11:45,270 --> 00:11:48,090 as I protect something that costs me $10,000 a year, 341 341 00:11:48,090 --> 00:11:48,990 I'm not going to do it. 342 342 00:11:48,990 --> 00:11:50,033 I would accept that risk 343 343 00:11:50,033 --> 00:11:52,350 If it's something that costs me a thousand dollars a year, 344 344 00:11:52,350 --> 00:11:55,170 but it protects me from a liability of $10,000 a year, 345 345 00:11:55,170 --> 00:11:57,150 I'm going to do that every single day 346 346 00:11:57,150 --> 00:11:58,947 because that is a great return on investment. 347 347 00:11:58,947 --> 00:12:00,300 And so you want to make sure you think 348 348 00:12:00,300 --> 00:12:01,470 about your cost of control 349 349 00:12:01,470 --> 00:12:03,450 when you're determining prioritization. 350 350 00:12:03,450 --> 00:12:05,700 And finally, we want to think about the amount of risk 351 351 00:12:05,700 --> 00:12:07,380 that a control mitigates. 352 352 00:12:07,380 --> 00:12:09,780 If I have a control that's going to mitigate a lot 353 353 00:12:09,780 --> 00:12:10,710 of risk for me, 354 354 00:12:10,710 --> 00:12:12,390 that might have a higher priority than one 355 355 00:12:12,390 --> 00:12:13,890 that only gives me a little bit 356 356 00:12:13,890 --> 00:12:15,330 of risk protection because again, 357 357 00:12:15,330 --> 00:12:17,880 there are only so many dollars 358 358 00:12:17,880 --> 00:12:19,650 and only so many hours in the day 359 359 00:12:19,650 --> 00:12:21,140 for you to be able to use to mitigate things. 360 360 00:12:21,140 --> 00:12:24,270 So you have to make sure you're making the best choices. 361 361 00:12:24,270 --> 00:12:26,220 Now, a controller is going to have a higher priority 362 362 00:12:26,220 --> 00:12:28,830 whenever it's part of a framework, a best practice 363 363 00:12:28,830 --> 00:12:30,930 or is required for regulatory reasons. 364 364 00:12:30,930 --> 00:12:31,800 I've already mentioned that; 365 365 00:12:31,800 --> 00:12:33,900 that's really important for us to think about. 366 366 00:12:33,900 --> 00:12:35,130 The next thing we have to think about again 367 367 00:12:35,130 --> 00:12:36,930 is the cost of control, right. 368 368 00:12:36,930 --> 00:12:38,610 All these things cost money, 369 369 00:12:38,610 --> 00:12:41,190 whether I'm using people to do it, that costs money too 370 370 00:12:41,190 --> 00:12:42,480 'cause I have to pay their labor 371 371 00:12:42,480 --> 00:12:45,360 or some kind of software or hardware, which I have to buy, 372 372 00:12:45,360 --> 00:12:46,350 all of that cost money. 373 373 00:12:46,350 --> 00:12:48,870 And so I have to weigh the cost of the control, 374 374 00:12:48,870 --> 00:12:49,980 and then I also want to think 375 375 00:12:49,980 --> 00:12:51,660 about my return on my investment. 376 376 00:12:51,660 --> 00:12:54,360 So when I think about this, there's a term called RSOI 377 377 00:12:54,360 --> 00:12:57,240 which is a return on security investment. 378 378 00:12:57,240 --> 00:12:58,890 As somebody who works in cybersecurity, 379 379 00:12:58,890 --> 00:13:01,710 you have to get very comfortable with selling the idea 380 380 00:13:01,710 --> 00:13:04,260 of what things you need to upper management 381 381 00:13:04,260 --> 00:13:05,370 because they're going to have to budget 382 382 00:13:05,370 --> 00:13:06,750 for it and give you money. 383 383 00:13:06,750 --> 00:13:10,200 Security costs us money, and we talk about RSOI; 384 384 00:13:10,200 --> 00:13:12,060 this is a metric that we use to calculate 385 385 00:13:12,060 --> 00:13:14,220 whether a security control is worth the cost 386 386 00:13:14,220 --> 00:13:16,230 of deploying it and maintaining it. 387 387 00:13:16,230 --> 00:13:18,088 As I said, everything we buy costs money, 388 388 00:13:18,088 --> 00:13:20,670 everything we support costs money 389 389 00:13:20,670 --> 00:13:22,440 and so we have to figure that out. 390 390 00:13:22,440 --> 00:13:23,640 Now, there's a nice little equation 391 391 00:13:23,640 --> 00:13:25,050 that you can use to figure this out 392 392 00:13:25,050 --> 00:13:30,050 and it's called ALE minus ALEm minus C divided by C 393 393 00:13:31,500 --> 00:13:33,570 and that's going to equal your ROSI. 394 394 00:13:33,570 --> 00:13:35,310 Now, what am I talking about here? 395 395 00:13:35,310 --> 00:13:38,280 Well, ALE is my annual loss expectancy. 396 396 00:13:38,280 --> 00:13:40,500 Then I'm going to subtract what the annual loss 397 397 00:13:40,500 --> 00:13:41,460 expectancy would be 398 398 00:13:41,460 --> 00:13:43,440 if I had the mitigating control in place. 399 399 00:13:43,440 --> 00:13:44,643 That's the ALEm. 400 400 00:13:45,540 --> 00:13:46,710 When I have that, 401 401 00:13:46,710 --> 00:13:48,840 I then subtract the cost of the thing I bought, 402 402 00:13:48,840 --> 00:13:49,890 that's the C, 403 403 00:13:49,890 --> 00:13:52,410 and then I take all of that divided by the cost 404 404 00:13:52,410 --> 00:13:54,710 and when I do that, that will give me an ROSI, 405 405 00:13:55,650 --> 00:13:58,110 which essentially is a ratio that shows me 406 406 00:13:58,110 --> 00:14:00,180 is this thing going to be valuable to me? 407 407 00:14:00,180 --> 00:14:02,700 And based on the RORSI can determine 408 408 00:14:02,700 --> 00:14:05,100 whether or not it's worth getting that mitigation 409 409 00:14:05,100 --> 00:14:08,460 in place or if that mitigation isn't very helpful. 410 410 00:14:08,460 --> 00:14:09,842 Now, when I think about risk, 411 411 00:14:09,842 --> 00:14:11,640 I want you to remember that risk is not always 412 412 00:14:11,640 --> 00:14:14,220 in opposition to an organization's goals. 413 413 00:14:14,220 --> 00:14:16,680 Sometimes you have to accept some risk 414 414 00:14:16,680 --> 00:14:19,050 you can't make risk go away completely. 415 415 00:14:19,050 --> 00:14:20,100 And this is something I like to bring 416 416 00:14:20,100 --> 00:14:22,290 up a lot in my security plus class as well. 417 417 00:14:22,290 --> 00:14:23,550 I bring up this chart 418 418 00:14:23,550 --> 00:14:26,370 and it's my operations versus security chart. 419 419 00:14:26,370 --> 00:14:28,830 If you've been working in security for any length of time, 420 420 00:14:28,830 --> 00:14:31,740 you probably have felt this in your real world. 421 421 00:14:31,740 --> 00:14:34,560 When you start having something that is very very secure, 422 422 00:14:34,560 --> 00:14:35,790 what happens? 423 423 00:14:35,790 --> 00:14:38,820 Operations tends to go down, why? 424 424 00:14:38,820 --> 00:14:41,610 Because all that extra security makes it more difficult 425 425 00:14:41,610 --> 00:14:43,200 for people to do their job. 426 426 00:14:43,200 --> 00:14:45,900 If I have to have two factor authentication on everything, 427 427 00:14:45,900 --> 00:14:47,040 I need to slow down 428 428 00:14:47,040 --> 00:14:49,650 and be able to have multifactor authentication that goes 429 429 00:14:49,650 --> 00:14:51,810 and text my cell phone before I can log in. 430 430 00:14:51,810 --> 00:14:53,904 And I need to encrypt everything that has more resources 431 431 00:14:53,904 --> 00:14:55,110 and overhead; 432 432 00:14:55,110 --> 00:14:57,960 all these different things that I do to protect the system, 433 433 00:14:57,960 --> 00:14:59,820 it slows everything down. 434 434 00:14:59,820 --> 00:15:00,653 Now, that's okay, 435 435 00:15:00,653 --> 00:15:02,160 we're going to have to have some of that 436 436 00:15:02,160 --> 00:15:04,080 to make sure that we are getting a secure system, 437 437 00:15:04,080 --> 00:15:05,190 but there is no such thing 438 438 00:15:05,190 --> 00:15:07,050 as a hundred percent secure system. 439 439 00:15:07,050 --> 00:15:09,420 In fact, the only a hundred percent secure system 440 440 00:15:09,420 --> 00:15:11,010 is a system that is powered down 441 441 00:15:11,010 --> 00:15:13,740 because a hacker cannot attack a powered-down system. 442 442 00:15:13,740 --> 00:15:16,260 But that powered down system gives you zero 443 443 00:15:16,260 --> 00:15:17,790 operational capability 444 444 00:15:17,790 --> 00:15:19,650 and so this is always a fight for us. 445 445 00:15:19,650 --> 00:15:21,240 Operations wants less controls, 446 446 00:15:21,240 --> 00:15:22,860 we want more controls for security 447 447 00:15:22,860 --> 00:15:24,690 and so we have to have this balancing act 448 448 00:15:24,690 --> 00:15:27,120 and we're going to find ourselves someplace on that line 449 449 00:15:27,120 --> 00:15:28,170 probably towards the middle. 450 450 00:15:28,170 --> 00:15:30,030 We're not going to be at one end or the other 451 451 00:15:30,030 --> 00:15:32,100 because there has to be a trade-off. 452 452 00:15:32,100 --> 00:15:33,240 That brings us to the concept 453 453 00:15:33,240 --> 00:15:35,550 of what we call an engineering trade-off. 454 454 00:15:35,550 --> 00:15:37,440 Now, an engineering trade-off is an assessment 455 455 00:15:37,440 --> 00:15:39,420 of the benefit of the risk reduction 456 456 00:15:39,420 --> 00:15:41,040 against the increased complexity 457 457 00:15:41,040 --> 00:15:44,100 or cost in a system designer specification. 458 458 00:15:44,100 --> 00:15:46,230 Now, I can make the most secure system out there 459 459 00:15:46,230 --> 00:15:49,520 that nobody can ever hack into, but it would be so hard 460 460 00:15:49,520 --> 00:15:51,780 for you to use and it would be so slow 461 461 00:15:51,780 --> 00:15:53,250 and so cost-prohibitive 462 462 00:15:53,250 --> 00:15:54,660 that I probably would never get my bosses 463 463 00:15:54,660 --> 00:15:55,830 to approve it, right; 464 464 00:15:55,830 --> 00:15:57,180 that's the idea of an engineering trade-off. 465 465 00:15:57,180 --> 00:15:59,343 So we make these trade-offs and we say, 466 466 00:15:59,343 --> 00:16:01,170 okay instead of having two-factor authentication, 467 467 00:16:01,170 --> 00:16:04,080 we're going to just use really long and strong passwords 468 468 00:16:04,080 --> 00:16:05,670 or it costs too much to issue smart cards 469 469 00:16:05,670 --> 00:16:07,050 for two factor authentication, 470 470 00:16:07,050 --> 00:16:08,700 so we're going to use people's cell phones even 471 471 00:16:08,700 --> 00:16:10,650 though that's not necessarily as secure. 472 472 00:16:10,650 --> 00:16:12,390 And so we make these different engineering trade-offs 473 473 00:16:12,390 --> 00:16:13,950 based on cost. 474 474 00:16:13,950 --> 00:16:15,210 Now, as we think about this 475 475 00:16:15,210 --> 00:16:17,820 it's all comes down to risk versus reward. 476 476 00:16:17,820 --> 00:16:19,080 If I'm in an organization 477 477 00:16:19,080 --> 00:16:20,940 I should not spend a million dollars a year 478 478 00:16:20,940 --> 00:16:24,270 to protect a system that's only valued at $50,000 per year. 479 479 00:16:24,270 --> 00:16:27,300 Even if I could completely eliminate all the risks involved. 480 480 00:16:27,300 --> 00:16:29,310 Instead, it would make more sense 481 481 00:16:29,310 --> 00:16:32,160 to have that system compromised multiple times a year, 482 482 00:16:32,160 --> 00:16:33,810 up to 20 times a year, 483 483 00:16:33,810 --> 00:16:35,940 before I would hit that million dollar mark, right. 484 484 00:16:35,940 --> 00:16:37,710 And so that's why we have to think about these things 485 485 00:16:37,710 --> 00:16:39,690 and we make these engineering trade-offs. 486 486 00:16:39,690 --> 00:16:41,280 And as the security administrators, 487 487 00:16:41,280 --> 00:16:42,870 we don't usually get to make the decisions 488 488 00:16:42,870 --> 00:16:44,400 for these engineering trade-offs; 489 489 00:16:44,400 --> 00:16:46,260 that's all done by the system architects, 490 490 00:16:46,260 --> 00:16:47,880 but we have to live with those trade-offs. 491 491 00:16:47,880 --> 00:16:49,920 And so understanding what those trade-offs are 492 492 00:16:49,920 --> 00:16:51,990 and understanding how you can mitigate some of those 493 493 00:16:51,990 --> 00:16:53,790 is going to help you in the real world.