Narrator: Remediation and mitigation. 2 2
Now, in this lesson, 3 3
we are going to talk about remediation and mitigation, 4 4
and this is really important 5 5
because as we've mentioned before, 6 6
you can't get risk down to zero. 7 7
Instead, we need to mitigate that risk 8 8
and we do that through a process of remediation. 9 9
Now, when we have a vulnerability, 10 10
this vulnerability must be prioritized and then remediated 11 11
because we have limited resources. 12 12
The way we usually do this is by looking at the risk. 13 13
If it's a critical risk, 14 14
then we're going to try to prioritize that higher. 15 15
If it's a high risk, it'll be a little less high than that. 16 16
If we go to medium or low, 17 17
it's going to be further down the list. 18 18
And eventually, we're going to have this one to N list 19 19
with one being the highest, most critical priority 20 20
and N being the 1258th priority 21 21
that we're going to get to sometime at some point. 22 22
And that's the idea of taking these vulnerabilities. 23 23
Now, once we have prioritized them, 24 24
we then start remediation. 25 25
When we talk about remediation, 26 26
remediation is the overall process of reducing exposure 27 27
to the effects of risk factors. 28 28
So remediation can be done lots of different ways. 29 29
If you patch of vulnerability, that's a form of remediation. 30 30
If you put in a compensating control, 31 31
that's a form of remediation. 32 32
If I isolate something from the network 33 33
because it's really, really dangerous, 34 34
that's a form of remediation too. 35 35
Remediation can take lots of different forms, 36 36
but the goal here is to reduce the exposure 37 37
to minimize the leftover residual risk. 38 38
Now, when we do our vulnerability management scans, 39 39
we are going to come back with a vulnerability report 40 40
and this report is going to offer recommendations 41 41
for mitigations and fixes to the various security problems. 42 42
They might say that for this particular vulnerability, 43 43
there's a patch available. 44 44
For this other one, 45 45
you need to use this configuration setting. 46 46
Whatever those things are, they're going to be included 47 47
in those vulnerability reports when you're using a tool 48 48
like Nessus or Qualys or OpenVAS. 49 49
Now, when we go to do our mitigation, 50 50
what is the goal when we conduct that mitigation? 51 51
Well, our goal is not to erase risk entirely 52 52
because that's just not possible. 53 53
There will always be some risk in our networks. 54 54
Instead, our goal is remediation 55 55
because remediation is going to mitigate risk exposure 56 56
down to an acceptable level 57 57
based on your organizational risk appetite. 58 58
Now, there are lots of different questions 59 59
you have to think about 60 60
when you start doing your mitigations here 61 61
and your remediations. 62 62
First, you're going to figure out how critical is the system. 63 63
If it's a really critical system, 64 64
that's going to determine what type of mitigations 65 65
or remediations you can do. 66 66
If it's a critical system to business operations, 67 67
I can't isolate it from the network and turn it off 68 68
even though that would solve the risk 69 69
because that thing is critical to my operation, 70 70
so I can't do that. 71 71
I also have to think about how difficult is remediation. 72 72
Is it as simple as changing a configuration setting 73 73
or installing a patch, 74 74
or do I need to completely overhaul 75 75
the entire configuration of this system? 76 76
Based on how difficult it is, 77 77
that's going to factor into when we remediate it 78 78
and how much money and resources we're going to put into it. 79 79
And the last thing we have to think about 80 80
is how risky is the issue? 81 81
Now, just because a thing says it's a critical issue 82 82
that depends on where it sits in your network. 83 83
When you get a CVSS score and it looks like 10.0 84 84
and it's something that's connected to the internet, 85 85
that might be a critical issue. 86 86
But if it's on an internal LAN 87 87
that has no external network connectivity 88 88
in a trusted enclave in a secure facility, 89 89
that's not nearly as risky 90 90
even though the CVSS would still say it has a 10.0 91 91
because it is what is standard for that particular risk. 92 92
So you have to look at each issue individually 93 93
and figure out exactly how risky is it. 94 94
Remember, our whole goal here is to reduce risk. 95 95
We're not going to eliminate risk. 96 96
We are going to reduce risk. 97 97
Now, as we try to reduce risk, 98 98
one of the most important things we use is change control. 99 99
This is an important part of risk mitigation. 100 100
Now, why is that? 101 101
Because so many of the risks that we're trying to mitigate 102 102
or remediate require us to make a change to a configuration 103 103
or install an update to a piece of software. 104 104
These are security patches, for instance. 105 105
All of this needs to go through your change control process 106 106
because if you just start installing things everywhere, 107 107
you're actually going to be adding more risk 108 108
to your network, not less. 109 109
So you want to make sure 110 110
there is an appropriate process that you're going to use 111 111
and it is going through the proper change control process. 112 112
Now, another thing we have to think about here 113 113
is risk acceptance, because there is going to be 114 114
some amount of risk that you just have to accept in life. 115 115
You cannot eliminate all risk. 116 116
And so when I talk about risk acceptance, 117 117
we're talking about that there is no countermeasure 118 118
that's put in place 119 119
because the level of risk is low enough 120 120
or the risk doesn't justify the cost 121 121
to mitigate the associated risk. 122 122
And I've mentioned this before, 123 123
if I have a piece of software 124 124
that might have a vulnerability 125 125
that relates to something like $10,000 per year, 126 126
but it would cost me a million dollars to remediate it, 127 127
that wouldn't be worth it 128 128
because I'm going to spend a million dollars to save $10,000. 129 129
I wouldn't do that. 130 130
We would simply accept that risk. 131 131
Similarly, if it's a very low level risk, 132 132
it may not justify spending any money 133 133
or any time or any resources on fixing that. 134 134
And so we have to think about these things. 135 135
Now, when you accept a risk, 136 136
you can't just say, "I accept it," and move on. 137 137
There's something you have to do. 138 138
When you accept a risk, 139 139
you need to make sure that risk is still being monitored. 140 140
Now, how do you do this? 141 141
Generally, you're going to put it on your risk register. 142 142
So you're still going to know that risk exists, 143 143
but you notated, 144 144
"I understand there's this amount of risk there 145 145
and I'm going to accept it." 146 146
That way, as we go through 147 147
and do our further on risk management later on 148 148
and we do more vulnerability scans and people identify this, 149 149
you can go, "No, I understand there's that risk there. 150 150
I've already accepted it. It was a low risk. 151 151
We've gone through that process 152 152
and we made the intelligent decision here." 153 153
Now, once you do your risk mitigations, 154 154
the last thing you need to do is go back and scan again. 155 155
This way, your vulnerability should be re-scanned 156 156
and verified against the mitigation that was put in place 157 157
to verify what residual risk sits there. 158 158
So if I had a server and there was 100 vulnerabilities 159 159
and I patched 50 of them and accepted the other 50, 160 160
I should then go through and scan it again 161 161
and that should come back showing me 162 162
that there's only 50 vulnerabilities left. 163 163
Now, based on those 50 vulnerabilities, 164 164
if they're all low or mediums, I can accept that risk. 165 165
If they're highs and criticals, I might not, 166 166
and I'd want to go back and do more patching. 167 167
That's the idea here when we start dealing 168 168
with verification of risk because after all, 169 169
just because you installed a patch 170 170
doesn't mean it actually solved the problem. 171 171
Sometimes you're going to install a patch 172 172
and that's going to fix one risk, 173 173
but it introduce two or three new risks. 174 174
So it's always important whenever you do a patch, 175 175
you go back and you verify it by doing another scan 176 176
and go through your results again 177 177
and verify what is the residual that's left over 178 178
because that is what you're accepting.