In this lesson, we're going to cover
threats and vulnerabilities.
Now, our job as cybersecurity professionals
is to prevent threats from exploiting
our enterprise systems' vulnerabilities.
Now, a threat is anything that could cause harm, loss,
damage, or compromise to our information technology systems.
And these threats come from external sources,
things like natural disasters,
cyber attacks, data integrity breaches,
disclosure of confidential information,
and many other incidents that can arise
during our daily operations.
Unfortunately for us though, as cybersecurity professionals,
we cannot fully control all of these threats,
but we can try to minimize their impact
by mitigating against them.
Unlike threats though, we do have the ability to control
our known vulnerabilities within our systems.
Now, a vulnerability is any weakness
in the system design or implementation.
As cybersecurity professionals, we can control
vulnerabilities because they come from internal factors,
things like software bugs, misconfigured software,
improperly protected network devices,
missing security patches, lacking physical security,
and so much more.
But these vulnerabilities are all within our control,
or at least within our organization's control
for us to prevent these vulnerabilities from being exploited
by mitigating, transferring, avoiding, or accepting the risk
involved with those vulnerabilities.
This then becomes essentially a risk management decision,
as we start looking at how we're going to handle
the vulnerabilities inside of our systems
and our networks at large.
Now, when it comes to threats and vulnerabilities,
it's important to remember that where they intersect,
that is where the risk to your enterprise systems
and networks actually lie.
This is a key point for you to understand,
because your job as a cybersecurity professional
is essentially to manage the risk
of those systems and networks.
And every decision that you make during your workday
is going to involve either mitigating, transferring, avoiding,
or accepting the risk within those systems.
Remember, if you have a threat, but there is no matching
vulnerability to it, then you have no risk.
The same holds true in reverse,
because if you have a vulnerability, but there's no matching
threat against it, there is also no risk.
Let's consider the example of trying to get to work
in the morning on time.
Now, your alarm clock goes off just after 6:00 a.m.
and you hop out of bed, you get dressed,
you eat your breakfast,
and now you have to get from your house over to your office.
But there are vulnerabilities and threats all around you
that could cause a bad outcome to occur.
And in this example, that would be you arriving to work late
and your boss getting upset with you.
Now, I know this seems like a pretty simple example,
but there is a variety of things that could happen
to cause this negative outcome to occur.
And as you go through your day, almost every day,
you're conducting risk management
without even thinking about it,
as you navigate from your house to your office.
So let's consider a few possible vulnerabilities
that could cause you to not get to work on time.
For example, you might've forgotten to fill up your car
the night before, so now you won't have enough gas
or energy or fuel to drive to work
without stopping at a fueling station.
We call this vulnerability a lack of preparation.
Or you might have forgotten that it was your day to drop off
the kids at school before you go into work.
So this is something we might call
a scheduling vulnerability.
Or maybe you forgot to perform the routine maintenance
on your car, and this could cause it to break down
before you get to the office.
And this we would call a vehicular vulnerability.
There's lots of different possible vulnerabilities
that could harm your plan of getting to work on time,
but you do have control over these because these
vulnerabilities were all created by internal factors
that you could have done something about.
Now, on the other side of the risk equation though,
there are several threats that are trying to prevent you
from arriving to work on time.
And these are usually going to be outside of your control.
For example, maybe an inpatient driver ended up
causing an accident on the freeway and now you're stuck
in traffic, which is going to cause a delay to your commute,
and you're now going to be late to arrive to work.
This is a realization of that risk,
because somebody caused the accident.
You can't prevent the other driver
from having driven irresponsibly and causing an accident
that delays your commute.
That is outside of your control
because it's an external threat factor.
Or there could have been a natural disaster,
like an earthquake, and this causes the road
between your home and your office
to be completely destroyed.
Now, I know I'm being a little bit melodramatic here,
but hopefully you're starting to get the idea here.
This is an external threat
that's caused by the environment itself.
You simply can't stop an earthquake,
it's going to happen when the earth wants it to happen.
So there is a threat out there that you won't arrive
to work on time if that earthquake actually happens,
and that risk is materialized.
So now that we have several threats
and several vulnerabilities that we've talked about,
we now need to think about what we can do about them.
Well, if we're worried about being late for work,
one thing we could do is wake up earlier.
Instead of waking up at 6:00 a.m.,
we could choose to wake up at 5:00 a.m.
That way, we have an extra hour of buffer time
in case anything goes wrong, like we need to stop for gas
or we run into traffic,
or we have to find an alternative road to work
because our normal roadway is blocked
because of earthquake damage.
In any of these scenarios, that extra time buffer
that we create by waking up an extra hour early
can serve as a mitigation to any of these risks
that might be realized.
We don't stop the traffic jam
or try to prevent the earthquake from happening,
but instead, we gave ourself time to change our routes
and still get ourself to work on time.
Now, this at its simplest form, is risk management.
It's finding different ways to minimize the likelihood
of a certain outcome from occurring,
and achieving the outcomes that you really want to achieve.
In the case of this daily commute,
our outcome is getting to work on time without being late.
In the world of cybersecurity though,
it means we want to provide a continuity
of services to our end users.
We want to maintain the overall security of our systems,
and we want to protect our organizations from data breaches
by minimizing our vulnerabilities.
Or utilizing proper mitigating actions to minimize
the impact that the threat would have
on our enterprise systems if the risk is realized.