Often we find a problem within our systems that
the normal corrective standard just can't be applied.
This can happen because of a variety of issues
including how our enterprise environment is set up.
It could be because of a specific policy.
Uh It could be for a variety of issues,
but we refer to this to an inhibitor to remediation.
When we look at the dependency on it systems as a whole,
we often find that some it systems are outdated.
They've got legacy component,
the specific software that we're utilizing doesn't work on updated systems.
Uh I consulted for a tanning slot at one point and the overriding P
OS system or the point of sale system as well as the inventory system that
attaining salon
used was backdated to Windows seven.
So if you were using any type of Windows product, after Windows seven,
the program specifically just didn't work.
Now,
we tried utilizing a Windows 10 system that
you could then backdate to utilize Windows seven settings
that didn't work. We tried it with Windows Eight
that didn't work. There was specific program requirements
or the way the program
it was originally designed where it just did
not implement well with anything past Windows Seven,
this obviously provided with a variety of issues
because Windows seven was no longer supported.
But this is an example of a dependency on it systems or outdated systems.
Uh There could be outdated policies in place
where policies were in place 1015 years ago.
And while they made good use
of the requirements or good use of the problems and technology, uh 15 years ago,
new technology has arisen new ways of doing things have arisen.
There's a better way of doing things, but those outdated policies came into play
and are hampering our ability to remediate certain issues.
Or in a sense,
there was a password policy put into place that specifically
said that it had to be eight characters of late
with at least one uppercase one lowercase one number and one special character.
That is an incredibly outdated policy when it comes to passwords. But
because of the way the policy was written, it wasn't just cut and dry like that,
it actually came to hamper our
remediation factors to provide multifactor authentication
because there was a line inside the policy that specifically
in no technology could be added or deducted
from the current policy without director approval.
And we couldn't get the director to sign off on it.
So it had to go through the entire remediation policy
for a change that literally took months when there was
a better way of doing things, right. Off the get go.
There could be resource constraints where we want to go through, we want to do it,
but the backlog of supplies isn't available.
This happened quite often in COVID where we were trying to upgrade systems,
we were trying to upgrade technologies
but their resources just weren't available.
This could often pose problems within the infrastructure
as a whole where we're having to do compan
controls because resource constraints are available.
Uh The complexity of the issue
if you've got
uh it professionals or cyber professionals,
and the issue is very complex and you're having to
add technology on top of technology in a specific format
that could pose issues. We've all had problems where we've ran into technology
and we wrote the code or we did something on the
process and it just didn't work because it was so complex,
the different systems that were interacting with it
just made the the configuration that we were trying
to pull off within the system as a whole,
not work all together and that fluidity just wasn't there.
So complexity can often pose different issues. In that specific sense.
We had to break down the different configuration and
provide this system with this configuration of this system,
with this configuration,
which obviously opened up some vulnerabilities which we had to mitigate
in order to get the system to work functionally correct.
There could be also resistance to change.
This happens quite often with older employees or with management where they
see the act of doing something and they're just very resistant to change
with the path for policy. For instance, getting Max
Fer I,
it actually go through
uh through the process of change policy was
a nightmare because for this specific company,
any time you wanted to change the policy,
it had to go through an entire council or
committee that voted on the password changing policy.
And even though it made sense and it needed to be enacted and it was,
should have been cut and dry,
there was a lot of resistance to that change because hey,
we've all always done it this way.
Why do we need to change it now?
And you'd be surprised how many people were just resistant,
the type of changes that can occur, especially in technology.
Uh We usually don't have that big of an issue
within it and cyber because we're used to changing constantly.
But sometimes you just run into people that just do not want to change and you have to
provide a capelli argument based on facts and even
then sometimes they're resistant to provide those different changes.
We can do a modum of understanding as well.
We talked about mo usa little bit earlier in this course,
but I wanted to reiterate it here in terms of
uh in terms of inhibitors to remediation.
If I have am ou in play
with different departments or between different organizations,
the way that we've been doing it could necessitate having a new mou written.
Well,
the mou was originally written and signed by people that aren't with
the company anymore or for a project that was long term,
maybe the project is getting ready to end in
three or four months and they don't see the need
to change the mou.
And so there's resistance to changing the mou,
which means there's resistance way we can do technology then requiring us to
hold two different systems in place to necessitate meeting that mou requirement,
mou can provide us with a great system
ability.
You can provide a great policy and a
great working understanding between two departments or organizations.
But it can also be an inhibitor to change if
we're required to meet specific
guidelines or specific functionality within systems
that call for outdated or legacy systems that we want to upgrade.
There's also service level agreements.
We often talked about slas meeting a specific requirement and we said, hey,
I want to have a 99.5%
uptime on this sl a well,
we may come up with a more secure system that provides us better security,
better encryption, but it also brings down the download speed or the upload speed.
And yet our sl a dictates that we have to have this set of Bandwidth or
these significant requirements.
And by adding those encryption and adding that security,
it actually drops that sla check down below what our sla is required to be.
And so that could be inhibited to change when
we have an sla that says you will meet 99.5%
of this data speed of, let's say a gigabyte
download speed.
And that's great. And all our Bandwidth didn't change.
But we started adding encryption, we started adding more security on the system.
And now instead of being that one gig,
we're at 9.9 did it have a vastly different change approach to it?
No, but it now does not meet that sl a requirement,
we have to go back through and do a new sl a agreement based on the security
and some businesses again, resistance to change, resistant to that sl a benefit.
Uh they're not going to want to do it.
So sl a checklist sl a good necessitate an inhibitor to change.
There's corporate governance or organizational governance where it
refers to a framework of processes and regulations.
This is often employed by different organizations
to provide a specific way of doing
things or specific way our uh our different departments interact with one another.
This often is transparent within it and it provides corporate leadership to allow
and assess ramifications of actions within our business
when it comes to decisions that they make, when this comes to remediation,
if they go into a fact and they start saying, hey, we want to do this framework.
This is what we employ, this is the regulation, we're meaning
this is how we do business
and we want to come through and say, oh,
we would like to increase our security or we'd like to do this.
Uh It may affect that regulation or it may affect
that corporate compliance that they're after which then says that
we can't do it because we've dropped our download speeds or
we've dropped our Bandwidth or maybe we're employing new security.
But the current
compliance regulations say that you will do
DES older encryption algorithm or Triple Des,
right?
But we just came out with this new thing called TLS or SSL that's
supposed to be bigger and better and all the credit across the board.
But the compliance and regulations say that you will hold up to Triple DES,
this could be an issue because even though we know SSL is better, way better,
the specific governance comes into play and says we will do Triple des, this often
times can be a problem when it comes
to corporate governance by outlining specific technologies.
So a lot of times when we talk about specific technologies, we will say or better
or better so meet the minimum clients or better in our corporate compliance.
But if that little word isn't, then there,
it could affect our uh our problems with remediation of moving forward.
And so that's an inhibitor to trying to fix a
security vulnerability by upgrading to a new encryption standard.
That's obviously better.
But because we didn't do that or better it has to go through the entire framework,
the entire governance protocols,
all that problems for going to a better um encryption standard
that has little bit of no effect on our overall infrastructure.
There's also a business process interruption anytime I
want to change something within our enterprise environment,
especially for security.
Uh Ultimately,
I'm most likely going to have to take a system down or I may have to patch a system or I
may have to upgrade that system which may have an
expanded lifetime or an expanded maintenance window within the process.
This means that let's say I want to upgrade a
router and the normal maintenance window is only four hours.
But because of the way our network is set up,
maybe we anticipate the router being offline for six hours.
This could provide an expended maintenance window or a
system downtime that the company is willing to accept,
which means we can't upgrade the router because
our maintenance window is only four hours,
but we need to do all the prep work.
This could pose some issues or problems to inhibitors
to remediation of fixing or replacing this router.
Well,
we have a router where the maintenance window should
only take three hours but the backup procedures to get
out of it and reconfigure the old router may take two hours if we have to back out,
this would override our maintenance window of only four hours to
be five hours and that may come into technical issues.
We've also seen technical issues where the original plan was to only take two hours.
We have a four hour maintenance window, everything's approved,
but we got so
uh streamline so focused on the issue that we
looked up and we saw this router that's down,
but it's been almost three hours and 45 minutes and we've exceeded
that maintenance window because there's no way we can back out with the
old router back in within 15 minutes to meet the maintenance window guidelines.
This could be technical issues that come into play.
It could also be technical issues in the fact that
we wanted to go to a new encryption standard,
but the newer encryption standard isn't taking place.
It's not doing hold properly.
Uh We're having configuration issues or software
issues with the system we're trying to
deal with that could be a technical issue and it's taking longer than expected.
We'd have system failures where again, the router just goes offline,
it takes the entire system offline.
We need to replace it.
And again, it's gonna take four or five hours to do that.
That could be a business process interruption where it's
inhibiting our ability to remediate the overall issue.
Uh We can also see where we've got a problem with insecurity,
we will replace the system.
But in order to replace this system,
we have to replace this system as well or we had
a system fail the night we were supposed to replace something.
So that's a system failure,
natural disasters come into play where we may have a tornado or a hurricane that
comes into play or even an earthquake or another natural disaster or fire flood.
It doesn't matter
that comes into play and we can't readily replace that issue or
fix that remediation process because we had something unexpected come into play.
And of course,
there's human error which makes up a majority of our
problems where originally we're going to replace this router,
it will only take three hours.
But all of a sudden we had somebody click on a phishing link.
Now we have an incident and it's all hands subject to fix this incident
because it's playing havoc with our systems
and we can't remediate the overall issue
that could be,
we also have degrading functionality. This could be from our malware infections.
It could be from any number of different aspects.
But usually with malware infections coming into play,
we have the malware that's taken hold within our system.
We have to get out that malware.
And because of that now,
we've degraded our functionality of our overall client base.
Uh It's not uncommon for malware to spread and when that printing takes place,
we no longer have access to the systems or the degraded
functionality of those systems because we have to go through and
wipe the program with the wipe that malware from existence
that poses issues. Give us creative functionality,
cache management issues where we're trying to run into patches,
we want to streamline that patch management window within the maintenance window.
And because we're implementing patches,
we have the rated functionality across our,
our spectrum of our enterprise environment,
which means our help desk can't normally do what they would like to do.
It's not uncommon,
especially in large environments where we're doing a major system
overhaul or we're doing a major patch and something that would
normally wouldn't be an issue like a password reset.
The help desk can no longer do because we're patching
the different systems and we told them not to do anything
so degraded functionality of that aspect,
uh denial service or distributed denial of service attacks on our systems.
Uh Clients can access the overall system.
It's restricted because we're hitting too much traffic
that can pose issues and of course,
over
restrictive controls or misconfigurations where
the client or the people trying to get access to our systems can't meet all those
problems or meet all the functionality of those
systems because we've made restrictive controls too much.
Uh And so they can't authenticate or they can do
one thing like they can write in the Excel spreadsheet,
but then they can't save to it
because their restrictive controls don't allow them to or they can read it
but they can't write to it or they can write to it,
but they can't save to it.
These are all restrictive controls that I've seen in the
past that just provide major issues with an overall environment
and degrades functionality across the board.
When we talk about legacy or proprietary systems,
I've given numerous examples of the past where I've
got an older system that's no longer supported,
but it contains a specific software or a specific data
that we can't easily translate over to a newer system.
This often relates to a major problem when we're trying to remediate an issue.
If I have got an older server and I've got newer technology that's coming out.
Not only do I have to protect that system that is out of state or at its end of life
and no longer support it.
But I also have to remediate security
around that specific legacy or proprietary system.
And this could easily come into different functionalities where
we're trying to do something with our network.
Uh But I've got this older legacy system that just doesn't work do play.
Uh This is a major issue especially across
larger environments where they may have two or three
different legacy or proprietary servers or even different
systems that we have to hide behind firewalls,
we have to add additional security, but we still to allow people to gain access to it
and we have to safeguard those systems and we want
to remediate or we want to upgrade our servers.
And we can't because of this singular legacy system,
this often resolves to the fact that we
segment that system into its own environment.
We virtualize it.
We do all kinds of different compliance issues or mitigation strategies to
protect that system and lower the impact of it but never underestimate legacy
systems. They're all over the place inside larger enterprise environments.