-: Risk Management. 2 2
In this lesson we're going to talk about risk management. 3 3
In every network we have threats and vulnerabilities 4 4
and when these two are combined, 5 5
this is where risk is going to exist within our networks. 6 6
Let's consider a simple example 7 7
you probably deal with every day in your own life. 8 8
When you're ready to go to bed at night 9 9
do you lock the doors to your house? 10 10
Well this little question each and every evening 11 11
is going to be answered by your actions 12 12
after you conduct a quick risk assessment 13 13
as part of your ability to manage the risk to your home, 14 14
its contents and your family. 15 15
First you consider the threats. 16 16
There might be a burglar who wants to get inside 17 17
and steal all your valuables, 18 18
or maybe you live in an area that's pretty windy, 19 19
and this could result in the door being pushed open at night 20 20
and the elements like the wind and the rain getting inside 21 21
and ruining all your stuff. 22 22
Next, you're going to consider the vulnerabilities 23 23
that could exist. 24 24
In this case, maybe you have a front door and a back door 25 25
and a garage door that leads into your home. 26 26
Now each of these represents a vulnerability 27 27
if you don't lock it before you go to bed at night. 28 28
Now should you lock these doors? 29 29
Well, that depends on your assessment of the situation. 30 30
If I was worried about a burglar, 31 31
I probably would lock all three of these doors. 32 32
But on the other hand 33 33
if I'm trying to mitigate the threat 34 34
of wind opening my door 35 35
I may only need to lock the front door and the back door 36 36
because the door leading into my garage 37 37
is already protected from the wind 38 38
because I have a large garage door there as well 39 39
that's already in the closed position 40 40
and it blocks the wind from entering my home. 41 41
Now I know this is a pretty silly example but at its core, 42 42
this is the basics of risk management. 43 43
Risk management is the identification, 44 44
evaluation, and prioritization of risks 45 45
followed by the allocation of resources 46 46
to minimize, monitor and control the probability 47 47
or impact of a vulnerability being exploited by a threat. 48 48
In order to conduct risk management 49 49
we often conduct risk assessments. 50 50
Now a risk assessment is a process 51 51
to identify potential hazards 52 52
and analyze what could happen if a hazard occurs. 53 53
Simply put a risk assessment 54 54
to determine its possible incidents, 55 55
their likelihood and consequences, 56 56
and your organization's tolerance for such events occurring. 57 57
To conduct risk management within our organizations 58 58
we usually use two different types of risk assessments; 59 59
these are known as security risk assessments 60 60
and business risk assessments. 61 61
Now a security risk assessment is used to identify, 62 62
assess, and implement key security controls 63 63
within an application system or network. 64 64
Security risk assessments may be conducted 65 65
as a threat assessment, a vulnerability assessment, 66 66
a penetration test, or a posture assessment. 67 67
Now in a threat assessment 68 68
we're going to focus on the identification 69 69
of the different threats that may wish to attack 70 70
or cause harm to our systems or networks. 71 71
A common tool that we use to do this is known 72 72
as the MITRE ATT&CK framework. 73 73
Now the MITRE ATT&CK framework 74 74
is a globally accessible knowledge base 75 75
of adversary tactics and techniques 76 76
based on real-world observations from the field 77 77
and it lets an administrator or analyst 78 78
walk through the typical methodologies 79 79
that are used by different threats to harm your networks 80 80
and identify where you should focus your resources 81 81
to better protect yourself. 82 82
Now a vulnerability assessment on the other hand 83 83
is focused on identifying, quantifying, 84 84
and prioritizing the risks and vulnerabilities 85 85
in a system or network. 86 86
To conduct a vulnerability assessment 87 87
a technician will normally use a vulnerability scanner, 88 88
something like Nessus or QualysGuard or OpenVAS 89 89
to enumerate each system or machine on that network 90 90
and identify the versions of every piece of hardware 91 91
and software that's being used. 92 92
And then it can create a summarized report of which systems 93 93
have open vulnerabilities 94 94
and which ones need to be remediated. 95 95
Now the big difference between these two 96 96
is whether you're looking at the target network 97 97
through the eyes of the attacker or the eyes of a defender. 98 98
Remember a threat is controlled by the attacker or an event. 99 99
They get to determine how and when it could be occurring. 100 100
Now a vulnerability on the other hand 101 101
is usually going to be within your control. 102 102
After all if you have an unpatched network router, 103 103
that's a vulnerability, 104 104
but you could remove that vulnerability 105 105
by patching the system or replacing that router. 106 106
Sure there are some vulnerabilities 107 107
that you can't remove completely 108 108
like the vulnerability of the network losing power, 109 109
but you can't can add additional controls 110 110
to help mitigate it and reduce that risk. 111 111
You can do this by adding battery backups 112 112
or diesel generators, for example, 113 113
to provide secondary and tertiary backup power 114 114
to your systems and your networks. 115 115
In some security risk assessments 116 116
they'll also combine a threat assessment 117 117
and a vulnerability assessment into one single threat 118 118
and vulnerability assessment 119 119
to provide a more holistic perspective of your network 120 120
and its security. 121 121
The third kind of security risk assessment we have 122 122
is a penetration test. 123 123
Now a penetration test is an attempt 124 124
to evaluate the security of an IT infrastructure 125 125
by safely trying to exploit vulnerabilities 126 126
within the system or networks. 127 127
Penetration tests are also useful 128 128
in validating the effectiveness 129 129
of your defensive mechanisms, 130 130
as well as the adherence of your security policies 131 131
by your end users. 132 132
Now a penetration test is a technical assessment 133 133
where ethical hackers within your organization 134 134
have permission to attempt to break into the network 135 135
to validate your security controls 136 136
and identify where improvements could be made. 137 137
Now the fourth type of security risk assessment we have 138 138
is known as a posture assessment. 139 139
A posture assessment is used to assess 140 140
your organization's attack surface 141 141
in order for you to better understanding 142 142
your cyber risk posture and exposure to threats 143 143
that are caused by misconfigurations and patching delays. 144 144
A posture assessment will often include four main steps: 145 145
First define your mission-critical components, 146 146
second, identify strengths, weaknesses, 147 147
and security issues. 148 148
Third, strengthen your position 149 149
and fourth stay in control. 150 150
By conducting a posture assessment, 151 151
you will ensure you're always up to date 152 152
on the status of your system security 153 153
and to ensure you always understand the healthier systems. 154 154
Often you'll combine this posture assessment 155 155
with a threat and vulnerability assessment as well. 156 156
Now, in addition to conducting security risk assessments 157 157
your organization may also conduct 158 158
business risk assessments. 159 159
Now a business risk assessment 160 160
is the process of identifying, 161 161
understanding and evaluating potential hazards 162 162
in the workplace concerning the day-to-day 163 163
running of your company. 164 164
Now there are two main types of business risk assessments, 165 165
process assessments, and vendor assessments. 166 166
A process assessment 167 167
is the discipline examination of the processes 168 168
used by your organization against a set of criteria 169 169
to determine the capability of these processes 170 170
to perform within the quality, cost, and schedule goals. 171 171
Basically that's a lot of words to say 172 172
this method is used to determine 173 173
if you're doing the right things 174 174
and if you're doing those things the correct way. 175 175
Now maybe you have a process in your organization 176 176
for the creation of a new user account on the network. 177 177
This process may have eight steps to creating the account 178 178
and then the entire process 179 179
should take less than one work day to complete 180 180
from the time the submitted request is received. 181 181
This is the basis of your process. 182 182
So during your process assessment 183 183
the auditor might watch you perform this process 184 184
and they'll see all the steps you do 185 185
to make sure they make sense 186 186
and to make sure you're doing them properly 187 187
and within the proper timeframes 188 188
to ensure it's all being done 189 189
within the requirements you've set. 190 190
Now after the assessment 191 191
there may be some recommendations 192 192
on how you could speed up the process 193 193
or take some steps out, or refine it 194 194
to get a better higher level of quality 195 195
within some sort of the process. 196 196
All of these are things that can come out 197 197
of a process assessment. 198 198
Now the second type of business risk assessment 199 199
is known as a vendor assessment. 200 200
A vendor assessment is defined 201 201
as the assessment or evaluation of prospective vendor 202 202
to determine if they can effectively meet the obligations 203 203
and the needs of the business regarding the product. 204 204
Now by conducting a vendor assessment 205 205
we can assess the suppliers and contractors ability 206 206
to ensure they're implementing and maintaining 207 207
the appropriate security controls. 208 208
This is also used to mitigate the threat 209 209
of a supply chain vulnerability. 210 210
For example, a few years ago, 211 211
there was a big issue with counterfeit Cisco devices, 212 212
these were routers and switches 213 213
that were being sold to other businesses. 214 214
Now these devices were being sold by third-party vendors, 215 215
not Cisco directly. 216 216
And these vendors themselves didn't even realize 217 217
that they were selling counterfeit devices. 218 218
The problem is that introduced new vulnerabilities 219 219
into the business networks all over the world 220 220
because these counterfeit Cisco devices 221 221
had malware installed in their firmware, 222 222
effectively giving the threat actors a backdoor 223 223
into various business networks all over the globe. 224 224
For reasons such as this, 225 225
it is really important to vet your vendors 226 226
and your suppliers to make sure they understand 227 227
what their supply chain looks like 228 228
and this way you can minimize your risk 229 229
of supply chain issues. 230 230
Also, you want to make sure that they won't fail 231 231
to deliver on their contractual obligations 232 232
and doing a vendor assessment can help with that too.