1
00:00:06,480 --> 00:00:09,270
- In lesson 24.2, we're
gonna be talking about

2
00:00:09,270 --> 00:00:12,330
Risk Assessment and Risk Analysis.

3
00:00:12,330 --> 00:00:14,760
Now risk assessment is a structured method

4
00:00:14,760 --> 00:00:16,500
to understand risk.

5
00:00:16,500 --> 00:00:18,690
And there are four distinct processes

6
00:00:18,690 --> 00:00:22,320
within a risk assessment,
risk identification

7
00:00:22,320 --> 00:00:27,320
risk analysis, risk
evaluation and risk response.

8
00:00:29,280 --> 00:00:32,490
So let's go through what
each of those actually mean.

9
00:00:32,490 --> 00:00:37,473
Identification, analysis,
evaluation and response.

10
00:00:38,430 --> 00:00:41,280
Risk identification is
the process of determining

11
00:00:41,280 --> 00:00:43,650
and documenting risk scenarios

12
00:00:43,650 --> 00:00:45,750
that the organization faces.

13
00:00:45,750 --> 00:00:47,130
What do we take into consideration?

14
00:00:47,130 --> 00:00:50,490
Well, exposures, threats, vulnerabilities,

15
00:00:50,490 --> 00:00:54,060
controls and consequences, right?

16
00:00:54,060 --> 00:00:58,863
So dangers, weaknesses,
controls and consequences.

17
00:01:00,720 --> 00:01:04,110
Analysis is the process
by which the likelihood

18
00:01:04,110 --> 00:01:08,040
and the impact, and the
level of risk are determined.

19
00:01:08,040 --> 00:01:09,450
So when we do a risk analysis,

20
00:01:09,450 --> 00:01:12,630
we're saying how likely is
it this event would occur?

21
00:01:12,630 --> 00:01:15,000
What would be the impact if it does?

22
00:01:15,000 --> 00:01:18,093
And from that, we can
determine our level of risk.

23
00:01:19,470 --> 00:01:21,660
Evaluation is the process of comparing

24
00:01:21,660 --> 00:01:23,970
the results of the risk analysis

25
00:01:23,970 --> 00:01:27,000
and the organization's
risk appetite statement

26
00:01:27,000 --> 00:01:28,473
and risk tolerance.

27
00:01:29,310 --> 00:01:32,010
And lastly, response is
a process of determining

28
00:01:32,010 --> 00:01:33,840
a recommended course of action,

29
00:01:33,840 --> 00:01:36,963
and that's also referred
to as risk treatment.

30
00:01:39,660 --> 00:01:41,790
And how often should we
do a risk assessment?

31
00:01:41,790 --> 00:01:44,250
Well, different organizations
do this differently.

32
00:01:44,250 --> 00:01:47,370
Some are ad hoc, some are
recurring, some do one time,

33
00:01:47,370 --> 00:01:51,420
some do continuous, and many
do a combination of these.

34
00:01:51,420 --> 00:01:54,120
An ad hoc risk assessment is a spontaneous

35
00:01:54,120 --> 00:01:56,310
sort of unplanned evaluation of risk,

36
00:01:56,310 --> 00:01:58,860
and it's typically undertaken in response

37
00:01:58,860 --> 00:02:02,163
to a particular event, a
specific event or issue.

38
00:02:03,210 --> 00:02:05,070
Recurring risk assessments is gonna be

39
00:02:05,070 --> 00:02:07,680
a periodic review of
risks that takes place

40
00:02:07,680 --> 00:02:09,210
on a regular basis.

41
00:02:09,210 --> 00:02:11,100
It could be weekly, it could be monthly,

42
00:02:11,100 --> 00:02:13,380
it could be quarterly,
it could be annually,

43
00:02:13,380 --> 00:02:14,213
it could be more.

44
00:02:14,213 --> 00:02:15,840
It could be every two
years, every three years,

45
00:02:15,840 --> 00:02:17,403
but it's scheduled out.

46
00:02:18,630 --> 00:02:19,920
One time risk assessment

47
00:02:19,920 --> 00:02:22,710
is a single evaluation of risk undertaken

48
00:02:22,710 --> 00:02:24,540
at a specific point in time,

49
00:02:24,540 --> 00:02:26,400
and that's typically in response

50
00:02:26,400 --> 00:02:28,830
to a new project or venture.

51
00:02:28,830 --> 00:02:30,570
So we might say for every new project

52
00:02:30,570 --> 00:02:32,160
there will be a risk assessment.

53
00:02:32,160 --> 00:02:34,050
We won't do a new project risk assessment

54
00:02:34,050 --> 00:02:35,130
on that ever again

55
00:02:35,130 --> 00:02:38,130
but we'll probably do
follow up risk assessments.

56
00:02:38,130 --> 00:02:40,620
But just maybe once
it's a full application

57
00:02:40,620 --> 00:02:41,583
or a full system.

58
00:02:42,510 --> 00:02:44,460
And then continuous risk assessment

59
00:02:44,460 --> 00:02:46,830
is the dynamic and iterative approach

60
00:02:46,830 --> 00:02:49,260
that involves constant monitoring of risks

61
00:02:49,260 --> 00:02:51,750
and changes in the risk environment.

62
00:02:51,750 --> 00:02:54,303
Again, most organizations
have a hybrid approach.

63
00:02:56,580 --> 00:03:00,120
Risk analysis is a process by determining

64
00:03:00,120 --> 00:03:02,430
the likelihood, the impact

65
00:03:02,430 --> 00:03:04,893
and what level of risk we actually have.

66
00:03:05,910 --> 00:03:08,400
Now, the outcome is inherent

67
00:03:08,400 --> 00:03:10,320
and residual risk ratings.

68
00:03:10,320 --> 00:03:12,180
Inherent risk is the level of risk

69
00:03:12,180 --> 00:03:14,793
before controls or safeguards
have been implemented.

70
00:03:15,660 --> 00:03:17,820
Residual risk is the level of risk

71
00:03:17,820 --> 00:03:21,180
after controls or safeguards
have been implemented.

72
00:03:21,180 --> 00:03:22,830
So we figure out the inherent risk,

73
00:03:22,830 --> 00:03:24,090
then we'll look at our controls,

74
00:03:24,090 --> 00:03:26,343
then we'll figure out our residual risk.

75
00:03:28,804 --> 00:03:31,980
Then there are two primary
risk analysis approaches

76
00:03:31,980 --> 00:03:34,290
qualitative and quantitative.

77
00:03:34,290 --> 00:03:37,590
A qualitative risk analysis uses narrative

78
00:03:37,590 --> 00:03:40,440
to describe likelihood and impact,

79
00:03:40,440 --> 00:03:42,420
and the outcome is a descriptor,

80
00:03:42,420 --> 00:03:45,120
like high risk, medium risk or low risk.

81
00:03:45,120 --> 00:03:46,650
Now, I don't wanna give you the impression

82
00:03:46,650 --> 00:03:48,540
that just because we're
using these descriptors

83
00:03:48,540 --> 00:03:51,210
or they're narrative that these
are subjective, they're not.

84
00:03:51,210 --> 00:03:54,033
They're generally very, very well defined.

85
00:03:55,260 --> 00:03:58,650
A quantitative risk
analysis assigns numeric

86
00:03:58,650 --> 00:04:02,640
and monetary values to
likelihood and impact.

87
00:04:02,640 --> 00:04:06,153
So the outcome is always gonna
be monetary or financial.

88
00:04:08,430 --> 00:04:10,650
So qualitative risk assessment uses these

89
00:04:10,650 --> 00:04:13,530
well-defined descriptive terminology

90
00:04:13,530 --> 00:04:18,003
to indicate likelihood
impact and level of risk.

91
00:04:18,840 --> 00:04:21,030
The qualitative risk analysis approach

92
00:04:21,030 --> 00:04:23,040
is appropriate in situations

93
00:04:23,040 --> 00:04:25,490
where there's non-tangible
elements of risk.

94
00:04:25,490 --> 00:04:29,640
So for example, reputation
that need to be considered

95
00:04:29,640 --> 00:04:33,570
and/or when there's a lack
of meaningful numeric data.

96
00:04:33,570 --> 00:04:35,520
Now, results are generally presented

97
00:04:35,520 --> 00:04:38,223
in what's known as a risk range map.

98
00:04:40,200 --> 00:04:42,900
There's an example of a risk range map,

99
00:04:42,900 --> 00:04:45,390
where we have different levels based on

100
00:04:45,390 --> 00:04:47,520
again the descriptors that we're using.

101
00:04:47,520 --> 00:04:50,070
And we ultimately determine whether it's

102
00:04:50,070 --> 00:04:54,183
low risk, an acceptable range
or in an unacceptable range.

103
00:04:57,810 --> 00:05:01,560
A quantitative risk analysis
assigns numeric values

104
00:05:01,560 --> 00:05:03,840
to all elements of the analysis.

105
00:05:03,840 --> 00:05:05,610
So let's go through those elements.

106
00:05:05,610 --> 00:05:08,343
And this comes up a
lot as a test question.

107
00:05:09,450 --> 00:05:11,340
We have an asset value.

108
00:05:11,340 --> 00:05:13,800
Now this is gonna be
whatever the target is

109
00:05:13,800 --> 00:05:15,210
of the risk assessment.

110
00:05:15,210 --> 00:05:17,640
That asset has to be assigned a value

111
00:05:17,640 --> 00:05:20,490
and that's the monetary
value of that resource

112
00:05:20,490 --> 00:05:23,520
or of that asset to the organization.

113
00:05:23,520 --> 00:05:24,840
Then we have exposure factor

114
00:05:24,840 --> 00:05:26,550
and you'll see that abbreviated as EF,

115
00:05:26,550 --> 00:05:29,010
and that's the percent of the asset value

116
00:05:29,010 --> 00:05:33,030
that would be impacted
if this event occurred.

117
00:05:33,030 --> 00:05:35,910
And it can be from 0% to 100%.

118
00:05:35,910 --> 00:05:38,660
So exposure factor is really
another way to say impact.

119
00:05:39,780 --> 00:05:41,233
Then we have what's known as an SLE.

120
00:05:41,233 --> 00:05:45,030
A single loss expectancy and
that's the financial impact

121
00:05:45,030 --> 00:05:47,160
of a single event or occurrence.

122
00:05:47,160 --> 00:05:49,290
And there's a formula
that you need to know

123
00:05:49,290 --> 00:05:51,510
which is single loss expectancy

124
00:05:51,510 --> 00:05:55,080
is the asset value times
the exposure factor.

125
00:05:55,080 --> 00:05:57,630
And we'll work through an
example in just a moment.

126
00:05:59,400 --> 00:06:01,440
Then we have the annualized
rate of occurrence

127
00:06:01,440 --> 00:06:04,410
which is how many times in
the course of a single year,

128
00:06:04,410 --> 00:06:08,283
in 12 months is the
event expected to occur?

129
00:06:09,750 --> 00:06:11,970
And that's just gonna
be a straight up number.

130
00:06:11,970 --> 00:06:13,350
If it's one, it would be one.

131
00:06:13,350 --> 00:06:15,120
If it's five, it would be five.

132
00:06:15,120 --> 00:06:17,400
What if we thought it would
happen every other year?

133
00:06:17,400 --> 00:06:21,360
Well, 0.5 every three years, 0.33, right?

134
00:06:21,360 --> 00:06:22,623
Every 10 years 0.10.

135
00:06:24,750 --> 00:06:27,750
And then lastly, we have our
annualized loss expectancy.

136
00:06:27,750 --> 00:06:31,740
And that's the financial
impact on an annualized basis.

137
00:06:31,740 --> 00:06:33,750
Why do we need to annualize?

138
00:06:33,750 --> 00:06:35,940
Because we annualize our
financial statements,

139
00:06:35,940 --> 00:06:38,070
we annualize our budgets.

140
00:06:38,070 --> 00:06:40,530
We make all of our decisions
on an annual basis.

141
00:06:40,530 --> 00:06:43,290
We have annual reporting, annual taxes.

142
00:06:43,290 --> 00:06:46,770
So we need to annualize the loss.

143
00:06:46,770 --> 00:06:49,530
So our annualized loss expectancy formula

144
00:06:49,530 --> 00:06:52,950
is ALE, annualized loss
expectancy equals SLE,

145
00:06:52,950 --> 00:06:55,770
single loss expectancy times ARO,

146
00:06:55,770 --> 00:06:58,260
annualized rate of occurrence.

147
00:06:58,260 --> 00:06:59,553
So let's illustrate that.

148
00:07:01,560 --> 00:07:04,380
So first, let's do a
single loss expectancy.

149
00:07:04,380 --> 00:07:06,150
Remember, single loss expectancy

150
00:07:06,150 --> 00:07:09,450
is asset value times exposure factor.

151
00:07:09,450 --> 00:07:11,790
Let's say the target of our analysis

152
00:07:11,790 --> 00:07:13,620
is an e-commerce server.

153
00:07:13,620 --> 00:07:16,980
And the way we decided to value the asset

154
00:07:16,980 --> 00:07:19,920
was just revenue from
one hour of e-commerce.

155
00:07:19,920 --> 00:07:21,840
It could have been revenue
from a day, a week,

156
00:07:21,840 --> 00:07:23,850
a month, a year, but
we're just doing revenue

157
00:07:23,850 --> 00:07:25,470
from an hour for simplicity's sake.

158
00:07:25,470 --> 00:07:26,730
And we're saying revenue

159
00:07:26,730 --> 00:07:30,690
from one hour of e-commerce is $20,000.

160
00:07:30,690 --> 00:07:32,190
And then the particular threat

161
00:07:32,190 --> 00:07:34,590
we're looking at here is a DDoS attack.

162
00:07:34,590 --> 00:07:36,900
And we're wondering
what would be the impact

163
00:07:36,900 --> 00:07:38,100
of a DDoS attack.

164
00:07:38,100 --> 00:07:40,650
And we consult with our consultants

165
00:07:40,650 --> 00:07:43,500
and they say, well, you know
if you had a DDoS attack

166
00:07:43,500 --> 00:07:47,370
on your e-commerce server probably 85%

167
00:07:47,370 --> 00:07:49,920
of your online activity would be impacted.

168
00:07:49,920 --> 00:07:53,520
So there's my exposure factor, 85%.

169
00:07:53,520 --> 00:07:57,240
So 20,000, which was my
asset value times 0.85,

170
00:07:57,240 --> 00:08:00,810
'cause of my 85% says my
single loss expectancy

171
00:08:00,810 --> 00:08:03,180
is going to be $17,000.

172
00:08:03,180 --> 00:08:06,660
So if I have one hour of DDoS disruption

173
00:08:06,660 --> 00:08:08,790
on my e-commerce platform

174
00:08:08,790 --> 00:08:12,510
my revenue hit is gonna be $17,000.

175
00:08:12,510 --> 00:08:14,460
Okay, so how do we annualize this?

176
00:08:14,460 --> 00:08:18,060
Well, remember, ALE is SLE times ARO.

177
00:08:18,060 --> 00:08:20,430
So that's the annualized loss expectancy

178
00:08:20,430 --> 00:08:23,010
is a single loss expectancy times

179
00:08:23,010 --> 00:08:25,020
the annualized rate of occurrence.

180
00:08:25,020 --> 00:08:26,850
So my single loss expectancy

181
00:08:26,850 --> 00:08:31,850
for an hour of DDoS disruption,
remember was $17,000.

182
00:08:31,890 --> 00:08:33,300
Again, we're talking to our consultants

183
00:08:33,300 --> 00:08:34,950
and we say based on the current threat

184
00:08:34,950 --> 00:08:36,360
and controls environment

185
00:08:36,360 --> 00:08:38,520
they say, well, you know,
we expect there'll be

186
00:08:38,520 --> 00:08:41,910
five hours of DDoS disruption in a year.

187
00:08:41,910 --> 00:08:44,670
That means we're gonna take our 17,000,

188
00:08:44,670 --> 00:08:46,230
that was for the one hour

189
00:08:46,230 --> 00:08:51,030
times five and we're gonna get $85,000,

190
00:08:51,030 --> 00:08:54,270
and that's gonna be our
loss on an annualized basis.

191
00:08:54,270 --> 00:08:56,130
At which point we're
gonna have to be making

192
00:08:56,130 --> 00:08:57,150
a bunch of decisions.

193
00:08:57,150 --> 00:08:58,350
Is that acceptable?

194
00:08:58,350 --> 00:09:01,800
And if it's not, what other
controls can we put in place

195
00:09:01,800 --> 00:09:03,930
to bring that number down?

196
00:09:03,930 --> 00:09:07,020
But we'll also have to consider
the cost of those controls

197
00:09:07,020 --> 00:09:08,430
and we know that those controls

198
00:09:08,430 --> 00:09:10,980
aren't gonna be 100% effective.

199
00:09:10,980 --> 00:09:12,600
So what still might be our loss

200
00:09:12,600 --> 00:09:15,000
we'll do that in a cost benefit analysis

201
00:09:15,000 --> 00:09:16,710
and we'll look at that in just a moment.

202
00:09:16,710 --> 00:09:18,690
But here's an alternate scenario.

203
00:09:18,690 --> 00:09:19,523
What if they said,

204
00:09:19,523 --> 00:09:21,450
well no, we only think
that there'll be about

205
00:09:21,450 --> 00:09:24,930
maybe 30 minutes of DDoS
disruption per year.

206
00:09:24,930 --> 00:09:27,180
That's really what we
think it'll be, right?

207
00:09:27,180 --> 00:09:28,950
30 minutes a year.

208
00:09:28,950 --> 00:09:31,980
Well, at that point would be 17,000,

209
00:09:31,980 --> 00:09:36,840
which was our one hour
single loss expectancy,

210
00:09:36,840 --> 00:09:40,920
times 0.5 and instead of 85,000,

211
00:09:40,920 --> 00:09:45,799
now we get 8,500, and 8,500
is a really different number.

212
00:09:45,799 --> 00:09:47,610
And we might say, oh, well for 8,500

213
00:09:47,610 --> 00:09:50,250
we're just gonna accept
that we'll take our chances.

214
00:09:50,250 --> 00:09:53,820
So knowing really what
the number actually is

215
00:09:53,820 --> 00:09:57,633
is very important and informs
lots of different decisions.

216
00:10:00,930 --> 00:10:03,540
But let's say it was 85,000,

217
00:10:03,540 --> 00:10:04,373
and now we're saying,

218
00:10:04,373 --> 00:10:07,830
okay we're gonna put some
additional controls in place.

219
00:10:07,830 --> 00:10:09,630
So let's walk through

220
00:10:09,630 --> 00:10:11,970
how we would do a cost benefit analysis.

221
00:10:11,970 --> 00:10:13,620
Well, we just did step one already.

222
00:10:13,620 --> 00:10:15,840
We calculated the
annualized loss expectancy

223
00:10:15,840 --> 00:10:18,480
and we'll refer to that as ALE-1.

224
00:10:18,480 --> 00:10:21,033
Then we'll identify mitigating controls.

225
00:10:22,260 --> 00:10:25,140
Then we're gonna recalculate the ALE

226
00:10:25,140 --> 00:10:26,670
with the mitigating controls.

227
00:10:26,670 --> 00:10:28,380
We'll do the same process again

228
00:10:28,380 --> 00:10:30,330
but knowing what our controls are

229
00:10:30,330 --> 00:10:31,770
and see how that changes,

230
00:10:31,770 --> 00:10:34,440
and that will be called ALE-2.

231
00:10:34,440 --> 00:10:35,910
Then ultimately what we're gonna do

232
00:10:35,910 --> 00:10:38,310
is we're gonna compare ALE-1

233
00:10:38,310 --> 00:10:40,770
like the 85,000 that we had in our example

234
00:10:40,770 --> 00:10:45,030
with ALE-2 because we've
hopefully brought that number down

235
00:10:45,030 --> 00:10:47,550
plus the cost of new controls.

236
00:10:47,550 --> 00:10:51,270
So maybe we've brought it down to 30,000,

237
00:10:51,270 --> 00:10:53,460
and our controls are gonna cost us five.

238
00:10:53,460 --> 00:10:56,973
So now it's 35,000 versus 85.

239
00:10:58,020 --> 00:10:59,370
Maybe brought it to 30,000,

240
00:10:59,370 --> 00:11:01,650
but our controls are gonna cost us a 100.

241
00:11:01,650 --> 00:11:03,180
Well, we would've lost 85,000

242
00:11:03,180 --> 00:11:06,330
and now with the new
controls it would be 130,000.

243
00:11:06,330 --> 00:11:07,740
Well, we're not gonna do that.

244
00:11:07,740 --> 00:11:10,830
So we're going to do the ALE-1,

245
00:11:10,830 --> 00:11:12,810
identify the mitigating controls,

246
00:11:12,810 --> 00:11:17,810
do ALE-2 and then compare ALE-1 to ALE-2

247
00:11:18,150 --> 00:11:20,220
plus the cost of the new control.

248
00:11:20,220 --> 00:11:21,660
And that cost of the new control

249
00:11:21,660 --> 00:11:23,520
isn't just the cost of buying it, right?

250
00:11:23,520 --> 00:11:25,980
It's also the cost of implementation,

251
00:11:25,980 --> 00:11:27,543
management and monitoring.

252
00:11:28,440 --> 00:11:31,620
And that, my friends, brings
us to a three second challenge.

253
00:11:31,620 --> 00:11:33,840
Five challenge questions,
three seconds each.

254
00:11:33,840 --> 00:11:34,940
You know how to do it.

255
00:11:35,820 --> 00:11:37,320
The level of risk before controls

256
00:11:37,320 --> 00:11:39,600
or safeguards have been implemented.

257
00:11:39,600 --> 00:11:41,103
One, two, three.

258
00:11:42,150 --> 00:11:43,560
It's gonna be inherent

259
00:11:43,560 --> 00:11:45,933
or the level of risk after is residual.

260
00:11:47,100 --> 00:11:49,350
The risk analysis approach
that's appropriate

261
00:11:49,350 --> 00:11:52,083
when there's a lack of
meaningful numeric data.

262
00:11:52,920 --> 00:11:54,573
One, two, three.

263
00:11:55,410 --> 00:11:56,910
That's gonna be a qualitative.

264
00:11:58,170 --> 00:12:02,943
Number three, AV times EF equals what?

265
00:12:04,380 --> 00:12:05,823
One, two, three.

266
00:12:06,810 --> 00:12:09,483
It's gonna be SLE, single loss expectancy.

267
00:12:10,980 --> 00:12:15,980
Number four SLE times ARO equals what?

268
00:12:16,650 --> 00:12:18,330
This is easy 'cause you've
already done the other one.

269
00:12:18,330 --> 00:12:20,013
One, two, three.

270
00:12:21,150 --> 00:12:24,840
It's gonna be annualized
loss expectancy or ALE.

271
00:12:24,840 --> 00:12:26,370
Lastly, number five.

272
00:12:26,370 --> 00:12:28,860
Dynamic and iterative
risk assessment approach

273
00:12:28,860 --> 00:12:31,380
that involves constant monitoring.

274
00:12:31,380 --> 00:12:32,520
What's that called?

275
00:12:32,520 --> 00:12:34,350
It was way at the beginning of the lesson.

276
00:12:34,350 --> 00:12:36,570
One, two, three.

277
00:12:36,570 --> 00:12:38,193
And that is continuous.

278
00:12:39,330 --> 00:12:41,310
And that brings us to
a security in action.

279
00:12:41,310 --> 00:12:44,760
And we're gonna do a
quantitative risk analysis.

280
00:12:44,760 --> 00:12:47,340
So your company hosts websites.

281
00:12:47,340 --> 00:12:52,260
You have 300 web servers that
are geographically segmented.

282
00:12:52,260 --> 00:12:56,460
Each server hosts an
average of 100 websites.

283
00:12:56,460 --> 00:12:59,550
Businesses pay a monthly fee of $75

284
00:12:59,550 --> 00:13:02,370
for money back guaranteed service.

285
00:13:02,370 --> 00:13:06,090
Your organization is concerned
about a ransomware attack.

286
00:13:06,090 --> 00:13:07,860
Now, your IT team estimates

287
00:13:07,860 --> 00:13:11,820
that a ransomware attack could
encrypt 60% of the servers

288
00:13:11,820 --> 00:13:14,400
before they could mitigate the attack.

289
00:13:14,400 --> 00:13:16,530
And they suggest that a ransom attack

290
00:13:16,530 --> 00:13:19,230
could occur every two years,

291
00:13:19,230 --> 00:13:22,020
and that it would take
three days to recover.

292
00:13:22,020 --> 00:13:24,933
So what's our SLE and our ALE?

293
00:13:25,920 --> 00:13:28,320
Okay, so let's go through
some numbers together.

294
00:13:29,160 --> 00:13:30,810
We've got 300 web servers.

295
00:13:30,810 --> 00:13:32,700
They're geographically segmented.

296
00:13:32,700 --> 00:13:35,460
Each one has 100 websites.

297
00:13:35,460 --> 00:13:39,240
Our businesses pay $75 for money
back guaranteed of service.

298
00:13:39,240 --> 00:13:40,320
So if they don't have service,

299
00:13:40,320 --> 00:13:41,730
I assume for any part of that month,

300
00:13:41,730 --> 00:13:43,620
they get their money back.

301
00:13:43,620 --> 00:13:45,873
You're concerned about ransomware.

302
00:13:46,920 --> 00:13:49,290
We said that if we had a ransomware attack

303
00:13:49,290 --> 00:13:51,540
probably get to about 60% encryption rate

304
00:13:51,540 --> 00:13:55,140
before we could mitigate the attack.

305
00:13:55,140 --> 00:13:58,320
We might be subject to one every two years

306
00:13:58,320 --> 00:14:01,500
and it would take us
three days to recover.

307
00:14:01,500 --> 00:14:05,040
So we wanna do some SLE
and ALE calculations.

308
00:14:05,040 --> 00:14:07,140
Go ahead and put me on
pause and see how you do,

309
00:14:07,140 --> 00:14:09,203
and come on back and
we'll do 'em together.

310
00:14:12,630 --> 00:14:15,900
Well, our asset value is going to be 300.

311
00:14:15,900 --> 00:14:20,900
That's our 300 web servers
times 100 times $75.

312
00:14:21,060 --> 00:14:23,280
So we'll do that 100 times 75,

313
00:14:23,280 --> 00:14:26,520
because we said each one hosts a average

314
00:14:26,520 --> 00:14:29,550
of 100 websites at $75 per website.

315
00:14:29,550 --> 00:14:32,550
So 100 times 75 would be per server.

316
00:14:32,550 --> 00:14:34,740
And we said we have 300 web servers.

317
00:14:34,740 --> 00:14:39,123
So it looks like we have
2,250,000 is our asset value.

318
00:14:40,560 --> 00:14:44,910
Our exposure factor we said was 60%.

319
00:14:44,910 --> 00:14:47,370
So our single loss expectancy

320
00:14:47,370 --> 00:14:51,693
is going to be 2,250,000 times 0.6.

321
00:14:52,980 --> 00:14:55,860
Why? Because they have
that money back guarantee.

322
00:14:55,860 --> 00:14:59,790
So we're assuming if they
have the three days of outage

323
00:14:59,790 --> 00:15:02,567
well, we're gonna have to
refund them that full $75,

324
00:15:02,567 --> 00:15:04,740
'cause we said they had
a money back guarantee.

325
00:15:04,740 --> 00:15:06,540
That's why we're doing it by the monthly.

326
00:15:06,540 --> 00:15:08,467
So the single loss expectancy

327
00:15:08,467 --> 00:15:13,467
$2,250,000 times 0.6 is $1,350,000, right?

328
00:15:17,910 --> 00:15:22,443
'Cause SLE is the AV times EF.

329
00:15:23,490 --> 00:15:24,900
Our annualized rate occurrence,

330
00:15:24,900 --> 00:15:26,880
so it could happen once every two years.

331
00:15:26,880 --> 00:15:28,280
That would make our ARO 0.5.

332
00:15:31,500 --> 00:15:33,900
So our annualized loss expectancy

333
00:15:33,900 --> 00:15:38,900
would be $1,000,350 times 0.5 or $675,000.

334
00:15:41,640 --> 00:15:46,050
And from that number, we
would decide, is it okay?

335
00:15:46,050 --> 00:15:47,190
Probably not.

336
00:15:47,190 --> 00:15:49,350
So what else are we gonna invest in

337
00:15:49,350 --> 00:15:52,953
to bring that number down to
a much more reasonable place?

338
00:15:54,120 --> 00:15:56,790
But you really need to be
able to go through these.

339
00:15:56,790 --> 00:16:00,240
Know definitely, definitely
know your formulas

340
00:16:00,240 --> 00:16:03,090
but be able to identify
the AV, the asset value,

341
00:16:03,090 --> 00:16:05,040
the EF, the exposure factor.

342
00:16:05,040 --> 00:16:09,660
Know the SLE formula,
which is AV times EF.

343
00:16:09,660 --> 00:16:12,330
Understand what an annualized
rate of occurrence is

344
00:16:12,330 --> 00:16:17,330
and know the ALE formula,
which is SLE times ARO.

345
00:16:18,120 --> 00:16:19,020
You can do that.

346
00:16:19,020 --> 00:16:21,630
Well, then you're doing
security in action.

347
00:16:21,630 --> 00:16:23,130
There's your word cloud.

348
00:16:23,130 --> 00:16:23,970
I know you know what to do

349
00:16:23,970 --> 00:16:26,160
but these are all really
important concepts

350
00:16:26,160 --> 00:16:28,410
and always come up on the exam.

351
00:16:28,410 --> 00:16:31,320
So really make sure you
understand these before moving on.

352
00:16:31,320 --> 00:16:33,210
If not, go back through the lesson

353
00:16:33,210 --> 00:16:34,410
and when you're ready

354
00:16:34,410 --> 00:16:36,560
I'll be waiting for
you at the next lesson.