A threat is a potential source of danger that
could exploit a vulnerability flaw or misconfiguration within our system
and causes adverse consequences within our organization's assets,
operations or objectives
within the slide.
Here, you can see likelihood versus impact where likelihood is,
how often or what is the chance of this occurring?
We could have an impact that is high ie our
server crashes or an impact that is very low where,
you know, we get a,
when we're looking at likelihood versus impact,
we need to take into account that I could have
a very high impact with a very low likelihood.
And while that is still precarious within our system,
we may only rate that as a medium flaw or a medium risk within our system,
risk versus likelihood or impact versus likelihood is
the model that most organizations use to understand
what level of risk I'm willing to undertake based on my system or in my organization,
we often do a risk analysis.
A risk analysis usually encompass different steps as you can see here.
But I really want to talk about risk analysis on an everyday basis, believe it or not,
you as a human being, you do a risk analysis every single day,
whether you believe it or not, when you get out of bed, first thing in the morning,
you consciously make a risk assessment.
You realize that, hey, I need to pull the blankets out from underneath me.
Very low impact.
If something to go wrong,
very low likelihood that something could go wrong leads to a very low risk
when I step out of bed and it's in my own master bedroom.
I have a very likelihood of stepping on something that I shouldn't.
I also have a very low impact that if I were
to stay up on something that it could hurt me.
Now, let's go back into my kid's bedroom. They have legos all over the place.
There are literally Barbie dolls lining the floor waiting
to jump out of me and kill my feet.
If I were to accidentally fall asleep in my son or daughter's
bed at night because we had company come over or something else,
then the likelihood of me stepping on something is incredibly high.
The impact is probably medium,
although I would consider LEGOS to be in that critical nature,
personal abuse aside.
So when we look at the risk matrix for likelihood versus impact,
we can see that uh risk analysis taking place.
We also do a risk analysis every day when we jump in our car. Do I plug in my seat belt?
Do I decide not to wear my seat belt because I'm only going five miles away
while there is a legal requirement for me to put my seatbelt on or be ticketed.
The fact is, is that I still have the option to do it or not to do it.
And I can provide that mitigating circumstance against my
risk analysis when I decide to drive my car.
If I drive my car to work every morning,
I presumptively do
a very quick risk analysis before I get behind the wheel. Have I been drinking?
No, I haven't. Did I put my seatbelt on?
That's going to mitigate any causes that could be
on the road for potential impact against my health.
If I get into a car accident without my seatbelt
on chances of or likelihood of having a major accident or
critical system failure within my internal organs is probably high that
would raise the impact of me having a hurtful incident.
If I put my seatbelt on the likelihood of having
a hurtful incident on my internal organs goes slightly down.
So I've done a compensating control or
a mitigating factor against that perceived threat.
And you unconsciously do this every single day.
If it's been raining outside,
I take a conscious effort. Do I want to be driving in a thunderstorm?
Do I want to go out and go get that gallon of milk or can it wait till tomorrow?
We do risk analysis every single day and believe it or not.
So do you, whether you realize it or not
within each of our minds,
we have something called risk tolerance and an organization is
no different if we take by driving the car,
uh, scenario back into risk tolerance.
You have to decide if it's storming outside
and I don't have my seatbelt working properly.
Am I willing to accept that level of risk as I go outside and drive my vehicle?
Chances are yes or no, depending on how slick the roads are. What if it's a tornado?
Probably not a good idea,
but still there's a risk tolerance level.
There's still people that go out there and chase tornadoes.
Their risk tolerance is probably higher than mine. What is my past training done?
Has that eliminated the impact or likelihood of something occurring?
What is the tolerance level that I'm willing to
accept for my personal wellbeing as I'm going forward,
enterprises do the same thing. They could take a risk and decide.
Am I willing to accept this risk with your own it department?
Am I willing to take the risk of
having telnet operational within my internal systems?
It's unsecure, unencrypted and open to the public.
If I do tell that there is a risk that something
bad could occur within my systems by leaving that port open.
My risk tolerance level needs to accumulate that
level of risk that I'm willing to accept.
We also have what's called risk response within risk response. We
naturally go through this order. Am I going to accept the risk?
Let's take my car example.
Once again,
if I decide to go out in the rain wearing
a seat belt to mitigate the risk with the training,
I have to get a gallon of milk in the middle of a thunderstorm with wet roads
and I decide to go to the store anyway. I'm accepting that risk.
I'm accepting the risk that something bad could happen to me.
If I decide, you know what, it's not worth the risk,
I'm gonna go back inside and you know what?
The kids don't need milk for their cereal or they can have something else.
I'm avoiding the risk. I am not taking the car
to the store. That's risk avoidance.
I could also transfer the risk, not so much in our thunderstorm example,
but let's say that every day I get in my vehicle,
there is still a risk that an accident could occur if that act accident occurs.
And I don't have car insurance, then I get into the accident.
I'm liable for the damages.
I'm liable if something happens to my car and I hit a tree, I have to pay that fee.
That is a risk that I had I accepted.
But if I have insurance, I've transferred that risk to the insurance company.
Yes, they're deductible.
But the insurance companies that come in and
pick up that cost that's known as risk transference
in an organization, we could do the same thing.
We can take out cybersecurity or incident insurance.
We can say, you know what,
there is a likelihood that malware could take place and it can wipe my servers.
I'm going to purchase risk transference or risk insurance against this happening.
I've transferred the risk off of my organization onto
the insurance company and paid them to do so
I can also do risk mitigation, which we believe I've already talked about. Right.
We tug in our seatbelt. We're providing a mitigation of risk.
I turn my headlights on because it's storming outside.
I've mitigated a little bit of risk by allowing other drivers to see that.
Hey, I'm here, my headlights are on. Let's not get into a head on collision.
This is risk mitigation in our enterprise environment.
We could do the same thing we could go through and say, you know what?
Let's turn off that telnet
port. We don't want to deal with that.
We only want to have SSH,
we do network hardening to mitigate as much of the risk as possible.
We're going to put antivirus systems on our, on our client computers.
That's risk mitigation. Could the malware still get in? Yes, it could.
We're still accepting that risk,
but we're mitigating it by providing some
antivirus software within our client machines.