Instructor: Risk Prioritization: 2 2
now we're going to talk about risk prioritization 3 3
in this lesson because it's important to remember 4 4
that not all risks are created equal. 5 5
Once we determine what a risk is 6 6
we have to determine what we're going to do about that risk. 7 7
And this brings up the question 8 8
of what should be done with a particular risk. 9 9
Well, there's lots of things you can do with it. 10 10
In fact, there are four main areas. 11 11
You can mitigate that risk using risk mitigation. 12 12
You can avoid that risk using risk avoidance. 13 13
You can transfer that risk using risk transference 14 14
and you can accept that risk using risk acceptance. 15 15
We're going to talk about each of these four in this lesson 16 16
but before we do, we have to talk about risk appetite. 17 17
Now, you may or may not be familiar 18 18
with the term risk appetite, 19 19
but essentially what it means is how much risk 20 20
is your organization willing to accept. 21 21
For example, if you're a big multi-billion dollar company 22 22
like Amazon, you might have a higher risk appetite 23 23
where if there's a risk that is a million dollars, 24 24
you'll take that risk because you can afford it. 25 25
But if you're a small company like me, 26 26
we can't afford to take a million dollar risk 27 27
that would bankrupt our company. 28 28
And so you have to have an idea 29 29
in your organization what is your risk appetite. 30 30
Some organizations are very heavy on their risk appetite. 31 31
They'll take on a lot of monetary risk 32 32
or a lot more dangerous risk. 33 33
If you're somebody who has a very low risk appetite 34 34
you're going to try to shine all risk 35 35
and try to avoid it and mitigate it as much as possible. 36 36
Knowing this, 37 37
and knowing what your organizational culture is, 38 38
will help you determine which of these four things 39 39
you are going to do when you deal with risk 40 40
and you're probably going to do some of each of them. 41 41
Now, let's go ahead and talk about each of these four. 42 42
The first one is risk mitigation, 43 43
now, risk mitigation is a risk response that reduces 44 44
a risk to fit within an organization's risk appetite. 45 45
And so you can see why I thought it was important 46 46
to talk about risk appetite. 47 47
If you have a high risk appetite, 48 48
you might need very little mitigation. 49 49
If you have a low risk appetite 50 50
you might need a lot of mitigation. 51 51
Now, when we talk about risk mitigation, 52 52
this also brings up the idea of risk deterrence 53 53
or risk reduction. 54 54
This refers to controls that can 55 55
either make a risk incident less likely or less costly. 56 56
So, for example, if you're worried 57 57
about getting into an accident in your car, 58 58
one of the risk mitigations you can do if you're worried 59 59
about hurting yourself in an accident 60 60
is put on your seatbelt or drive a car with airbags. 61 61
Both of those are not going to stop you from getting 62 62
into that accident necessarily, 63 63
but they will reduce the harm that would happen 64 64
if you were in an accident 65 65
because you're mitigating that risk. 66 66
Now, another thing we might look at 67 67
in the software world is patching our software. 68 68
We do vulnerability assessments. 69 69
We scan our network to find out 70 70
what systems have not been patched. 71 71
We find those systems and we apply the patch to them; 72 72
that is going to reduce our risk. 73 73
Does that protect our systems 100%? 74 74
No, of course not, 75 75
there's still risk to that system, 76 76
but you are getting a lot 77 77
of those easy mitigation out of the way 78 78
by patching those systems against known vulnerabilities. 79 79
That is the idea of risk mitigation. 80 80
Now, the second category we have is known 81 81
as risk avoidance. 82 82
This is a risk response that involves ceasing an activity 83 83
that presents risk. 84 84
So I'll give you a great example of this. 85 85
My wife doesn't like to fly. 86 86
In fact, she is petrified of small airplanes. 87 87
She is afraid that if she gets into a Cessna 88 88
it's going to go up and crash down into a lake. 89 89
Now, her fear of these small planes 90 90
is not unfounded though, 91 91
she actually had a friend who died 92 92
when she was very young 93 93
because their family died 94 94
in one of these small plane crashes. 95 95
And because of that. 96 96
my wife refuses to go onto a small plane. 97 97
Now, I've been able to get her on larger planes. 98 98
She'll go on a commercial plane 99 99
'cause she feels they're a little bit safer, 100 100
but she still doesn't like them. 101 101
But again, she is not going to go on a small plane. 102 102
It's something she's decided in her life, 103 103
it's not worth the risk. 104 104
So she has avoided going on small planes her entire life 105 105
and she refuses to go on 'em. 106 106
She'll go on a jumbo jet, 107 107
but she will not go on one of those Cessnas. 108 108
And that is the idea of risk avoidance: 109 109
this risk to her is just so bad 110 110
that she is not willing to take the chance at all 111 111
and that is risk avoidance. 112 112
Now, unfortunately 113 113
risk avoidance is not really a valid solution 114 114
most of the time because you simply can't avoid all risks. 115 115
There are some risks you can avoid, 116 116
but if you wanted to avoid all risk across everything 117 117
that's just not possible. 118 118
So we're going to have to combine some 119 119
of these strategies as we go. 120 120
The next one we're going to talk about is risk transference. 121 121
We talk about risk transference. 122 122
This is a risk response that involves moving 123 123
or sharing the responsibility of risk to another entity. 124 124
Now what does this really mean? 125 125
Well, let me give you a really easy example. 126 126
I used the car example earlier. 127 127
If you're worried about getting into a car accident, 128 128
you can mitigate the risk by putting on your seatbelt 129 129
to help yourself not get hurt as badly, that's a mitigation. 130 130
But if I wanted to transfer the risk of this car accident, 131 131
what are one of the things that we all have for our cars? 132 132
We have car insurance, right. 133 133
So if I get into a car accident 134 134
and I smash up the front of my car, 135 135
I call up my insurance company they write me a check 136 136
and I get a new car or I get my car fixed. 137 137
I transferred the financial loss of that vehicle 138 138
to the insurance company by paying them a monthly premium 139 139
they will then cover that risk for me. 140 140
I transferred it and gave it to this other entity, 141 141
this third party and that's the idea. 142 142
Now, how does this apply in the cyber world? 143 143
Well, there's lots of ways we can do this. 144 144
One of the ways is we can actually use cyber insurance. 145 145
There are cyber insurance policies out there 146 146
against data breaches now. 147 147
Your company can pay a policy 148 148
to a cyber insurance company 149 149
and if you are hacked they will pay for the response 150 150
and they'll pay for the cleanup 151 151
and they'll pay for any damages to your customers; 152 152
that is one way to transfer that liability 153 153
over to this third party using risk transference. 154 154
Now, another way you can do risk transference 155 155
is you can actually outsource a service. 156 156
Now, for example, I don't host my own web servers anymore. 157 157
We pay a third party and that's their job. 158 158
They host our web servers for us. 159 159
They host it in a place that has 24/7 power and electricity 160 160
and good connectivity and all of those things 161 161
and they make sure they actually patch our servers 162 162
against vulnerabilities and provide us those protections. 163 163
Now, could we do it ourself? 164 164
Yes, but again, we're a training company now. 165 165
We're not focused on running these systems anymore. 166 166
I've done that in my career. 167 167
I don't want to have to have that responsibility 168 168
and that extra baggage inside our company. 169 169
We instead want to focus on providing you the best training, 170 170
not on providing the best servers. 171 171
We can outsource somebody else 172 172
to provide those best servers for us. 173 173
And that's the idea 174 174
of risk transference because they're responsible 175 175
for the maintenance, the upkeep, the patching, the software; 176 176
all of that has been transferred to that organization. 177 177
Now, I can't transfer away the responsibility 178 178
or the reputational damage to your organization. 179 179
As I was saying, 180 180
I transfer away my web service to a third party company, 181 181
but if we have a data breach, 182 182
it's still our company 183 183
that's going to have a tarnished reputation 184 184
and we're still going to take the heat for that. 185 185
Now, they're going to pay for all the data breach 186 186
and they're going to pay for all the cleanup 187 187
and the response because that's part of their contract. 188 188
But my organization still is going to look bad. 189 189
I can't simply say, Hey, XYZ company is at fault. 190 190
You aren't going to believe that as a student, 191 191
you're still looking at me because you are my customer. 192 192
You weren't their customer 193 193
and so that's one of those risks 194 194
that you have to think about 195 195
when you're doing risk transference. 196 196
Now, the final one we want to talk about is risk acceptance. 197 197
Now, with risk acceptance, this is a risk response 198 198
that involves determining what a risk is 199 199
within the organization's risk appetite 200 200
and there's going to be no other countermeasures other 201 201
than monitoring will be needed here. 202 202
Now, what we're talking about 203 203
with risk acceptance is we simply say, I know this is risky. 204 204
I know this is dangerous, 205 205
but it's a small enough danger that I'm going to take it. 206 206
For instance, that if you get on a commercial plane, 207 207
it could crash, 208 208
but it's a small enough risk that most 209 209
of us will get on a commercial plane and take that chance. 210 210
Just like there's a risk of you getting 211 211
into a car accident when you go to work, 212 212
you might take that risk. 213 213
Now, you might also accept what's left over in the risk. 214 214
So if I have my car, 215 215
I already have car insurance to cover the cost. 216 216
I already am wearing my seatbelt to mitigate that. 217 217
I have transference. 218 218
I have mitigation, but I could still get into an accident 219 219
and I could still get hurt, 220 220
but I'm accepting that risk that's left 221 221
after I've transferred and mitigated the big areas of risk, 222 222
which was the cost of replacing my car 223 223
or the ability to actually get someplace. 224 224
And I need to do that so I have worn my seatbelt; 225 225
I have an airbags. 226 226
I have a safe car 227 227
and I'm going to go ahead and accept the rest of that risk. 228 228
Now, let's talk about the exam for just a moment here. 229 229
I want to give you a few quick tips 230 230
in regards to choosing the best risk response. 231 231
Now, the most common one you're going to see is mitigation. 232 232
Mitigation involves adding controls. 233 233
So whenever you think about mitigation, 234 234
I want you to think about adding controls. 235 235
Then we want to talk about avoidance. 236 236
Avoidance is our least common one 237 237
and it involves changing your course of action 238 238
or the systems of use. 239 239
So when I think about this 240 240
I like to think about changing plans. 241 241
I planned on doing this, but I'm going to avoid it 242 242
and I'm going to do something else instead. 243 243
The next one we want to talk about is transference. 244 244
Transference is all about moving the risk to a third party. 245 245
On the exam, 246 246
this is almost always going to involve some kind 247 247
of insurance policy being purchased. 248 248
For example, my company offers a form of risk transference 249 249
for our students who are afraid they might fail the exam. 250 250
If you go and buy your exam voucher from diontraining.com, 251 251
you can purchase an add-on product that we have 252 252
for an extra fee. 253 253
And this gives you a new exam voucher, 254 254
if you fail the first time. 255 255
Now, normally when you go to Comp TIA 256 256
and you buy your exam voucher, you'll pay full price 257 257
and you'll pay about $350. 258 258
Once you buy that voucher, 259 259
if you take the exam and fail it, 260 260
you have to go buy another voucher 261 261
before you can retake the exam. 262 262
Well, with our add-on product, you buy the voucher 263 263
from us and we charge you a little bit extra 264 264
for this extra option we call Take2. 265 265
This allows you to pay this upfront feed us that's less 266 266
than the cost of a new exam voucher. 267 267
We take on the risk for you 268 268
that if you fail the exam, 269 269
we will buy you a new voucher for the full $350. 270 270
and so it saves you money if you fail. 271 271
But if you pass the first time you paid us 272 272
that extra money really for nothing, right, 273 273
because you didn't crash your car. 274 274
I think about it like car insurance, 275 275
you pay for car insurance hoping you never crash your car. 276 276
It's the same thing here with this failed exam transference. 277 277
You're hoping that you're not going to have to use it, 278 278
but if you do, it's a great thing to have 279 279
and so that's the idea here. 280 280
It's a form of transference 281 281
or insurance against you failing your exam. 282 282
And so you're buying that extra peace of mind 283 283
to know that you're going to have a second attempt 284 284
if you need it. 285 285
And then finally we have acceptance; 286 286
acceptance is when you accept the risk. 287 287
It has to be less than the organizational's risk appetite. 288 288
Here normally we're going to accept a risk 289 289
for small things that are unlikely to happen. 290 290
For example, I accept the risk 291 291
then alien invasion may occur and put me out of business. 292 292
I also believe that it's going to be extremely unlikely 293 293
that an alien invasion's going to happen. 294 294
So I haven't put forth any resources, thought 295 295
or planning into preparing for an alien invasion. 296 296
Similarly, I haven't planned for the end 297 297
of the world or a zombie apocalypse. 298 298
I just don't think those things are big deals. 299 299
On the other hand, as I said, 300 300
I spent a good deal of money trying to add controls 301 301
to protect our business from power outages, from flooding, 302 302
from hurricanes, from earthquakes. 303 303
Those are all things that we're subject 304 304
to by living in Puerto Rico. 305 305
And so we have to have protections 306 306
in place for those things 307 307
and those are things we are going to add controls to. 308 308
We're not going to accept those and just say, 309 309
oh, well if a hurricane comes 310 310
and we're out of power for three months, 311 311
we'll just be out of offline for three months, 312 312
that wouldn't be good for our customers 313 313
so we're not going to do that. 314 314
So this is the idea here. 315 315
So what I want you to remember is on the exam, 316 316
this little cheat sheet you see here, mitigation controls, 317 317
avoidance, changing plans, transference insurance 318 318
and acceptance is for low risk activities. 319 319
Alright, now with all that mine, 320 320
let's start talking about security control prioritization 321 321
because there are a million controls out there 322 322
and you have to decide which ones you're going to use. 323 323
Now, there are three main areas we're going to talk about 324 324
with security controls. 325 325
First, we have to talk about whether the control is required 326 326
by a framework, a best practice or regulation. 327 327
If it's required by one of those three, 328 328
it's going to have a higher priority for us 329 329
and we're going to do it, especially if it's a regulation. 330 330
Regulation means law; 331 331
it means you can be fined 332 332
or put out of business if you don't do it. 333 333
So you need to make sure you're following those things. 334 334
Second, we need to think about the cost of the control. 335 335
This is going to require us to think both 336 336
in what it costs us to get the control initially, 337 337
as well as the ongoing maintenance 338 338
and support for that control. 339 339
If this control is going to cost me a million dollars a year, 340 340
as I protect something that costs me $10,000 a year, 341 341
I'm not going to do it. 342 342
I would accept that risk 343 343
If it's something that costs me a thousand dollars a year, 344 344
but it protects me from a liability of $10,000 a year, 345 345
I'm going to do that every single day 346 346
because that is a great return on investment. 347 347
And so you want to make sure you think 348 348
about your cost of control 349 349
when you're determining prioritization. 350 350
And finally, we want to think about the amount of risk 351 351
that a control mitigates. 352 352
If I have a control that's going to mitigate a lot 353 353
of risk for me, 354 354
that might have a higher priority than one 355 355
that only gives me a little bit 356 356
of risk protection because again, 357 357
there are only so many dollars 358 358
and only so many hours in the day 359 359
for you to be able to use to mitigate things. 360 360
So you have to make sure you're making the best choices. 361 361
Now, a controller is going to have a higher priority 362 362
whenever it's part of a framework, a best practice 363 363
or is required for regulatory reasons. 364 364
I've already mentioned that; 365 365
that's really important for us to think about. 366 366
The next thing we have to think about again 367 367
is the cost of control, right. 368 368
All these things cost money, 369 369
whether I'm using people to do it, that costs money too 370 370
'cause I have to pay their labor 371 371
or some kind of software or hardware, which I have to buy, 372 372
all of that cost money. 373 373
And so I have to weigh the cost of the control, 374 374
and then I also want to think 375 375
about my return on my investment. 376 376
So when I think about this, there's a term called RSOI 377 377
which is a return on security investment. 378 378
As somebody who works in cybersecurity, 379 379
you have to get very comfortable with selling the idea 380 380
of what things you need to upper management 381 381
because they're going to have to budget 382 382
for it and give you money. 383 383
Security costs us money, and we talk about RSOI; 384 384
this is a metric that we use to calculate 385 385
whether a security control is worth the cost 386 386
of deploying it and maintaining it. 387 387
As I said, everything we buy costs money, 388 388
everything we support costs money 389 389
and so we have to figure that out. 390 390
Now, there's a nice little equation 391 391
that you can use to figure this out 392 392
and it's called ALE minus ALEm minus C divided by C 393 393
and that's going to equal your ROSI. 394 394
Now, what am I talking about here? 395 395
Well, ALE is my annual loss expectancy. 396 396
Then I'm going to subtract what the annual loss 397 397
expectancy would be 398 398
if I had the mitigating control in place. 399 399
That's the ALEm. 400 400
When I have that, 401 401
I then subtract the cost of the thing I bought, 402 402
that's the C, 403 403
and then I take all of that divided by the cost 404 404
and when I do that, that will give me an ROSI, 405 405
which essentially is a ratio that shows me 406 406
is this thing going to be valuable to me? 407 407
And based on the RORSI can determine 408 408
whether or not it's worth getting that mitigation 409 409
in place or if that mitigation isn't very helpful. 410 410
Now, when I think about risk, 411 411
I want you to remember that risk is not always 412 412
in opposition to an organization's goals. 413 413
Sometimes you have to accept some risk 414 414
you can't make risk go away completely. 415 415
And this is something I like to bring 416 416
up a lot in my security plus class as well. 417 417
I bring up this chart 418 418
and it's my operations versus security chart. 419 419
If you've been working in security for any length of time, 420 420
you probably have felt this in your real world. 421 421
When you start having something that is very very secure, 422 422
what happens? 423 423
Operations tends to go down, why? 424 424
Because all that extra security makes it more difficult 425 425
for people to do their job. 426 426
If I have to have two factor authentication on everything, 427 427
I need to slow down 428 428
and be able to have multifactor authentication that goes 429 429
and text my cell phone before I can log in. 430 430
And I need to encrypt everything that has more resources 431 431
and overhead; 432 432
all these different things that I do to protect the system, 433 433
it slows everything down. 434 434
Now, that's okay, 435 435
we're going to have to have some of that 436 436
to make sure that we are getting a secure system, 437 437
but there is no such thing 438 438
as a hundred percent secure system. 439 439
In fact, the only a hundred percent secure system 440 440
is a system that is powered down 441 441
because a hacker cannot attack a powered-down system. 442 442
But that powered down system gives you zero 443 443
operational capability 444 444
and so this is always a fight for us. 445 445
Operations wants less controls, 446 446
we want more controls for security 447 447
and so we have to have this balancing act 448 448
and we're going to find ourselves someplace on that line 449 449
probably towards the middle. 450 450
We're not going to be at one end or the other 451 451
because there has to be a trade-off. 452 452
That brings us to the concept 453 453
of what we call an engineering trade-off. 454 454
Now, an engineering trade-off is an assessment 455 455
of the benefit of the risk reduction 456 456
against the increased complexity 457 457
or cost in a system designer specification. 458 458
Now, I can make the most secure system out there 459 459
that nobody can ever hack into, but it would be so hard 460 460
for you to use and it would be so slow 461 461
and so cost-prohibitive 462 462
that I probably would never get my bosses 463 463
to approve it, right; 464 464
that's the idea of an engineering trade-off. 465 465
So we make these trade-offs and we say, 466 466
okay instead of having two-factor authentication, 467 467
we're going to just use really long and strong passwords 468 468
or it costs too much to issue smart cards 469 469
for two factor authentication, 470 470
so we're going to use people's cell phones even 471 471
though that's not necessarily as secure. 472 472
And so we make these different engineering trade-offs 473 473
based on cost. 474 474
Now, as we think about this 475 475
it's all comes down to risk versus reward. 476 476
If I'm in an organization 477 477
I should not spend a million dollars a year 478 478
to protect a system that's only valued at $50,000 per year. 479 479
Even if I could completely eliminate all the risks involved. 480 480
Instead, it would make more sense 481 481
to have that system compromised multiple times a year, 482 482
up to 20 times a year, 483 483
before I would hit that million dollar mark, right. 484 484
And so that's why we have to think about these things 485 485
and we make these engineering trade-offs. 486 486
And as the security administrators, 487 487
we don't usually get to make the decisions 488 488
for these engineering trade-offs; 489 489
that's all done by the system architects, 490 490
but we have to live with those trade-offs. 491 491
And so understanding what those trade-offs are 492 492
and understanding how you can mitigate some of those 493 493
is going to help you in the real world.