IT security professionals from time to time are required to perform assessment 2 2
and analysis around risk. 3 3
What does that entail? 4 4
That conversation starts right now. 5 5
>> You're watching ITProTV. 6 6
[MUSIC] 7 7
>> Hello, ladies and gentlemen, thank you for tuning in to more of the security plus 8 8
show, yet we are having so much fun off screen that we decided, well, 9 9
let's turn the cameras on record and bring you all into some of that fun as well. 10 10
I'm your host, Wes Bryan, joined in the studios again by Mr. Adam Gordon. 11 11
And we are going to be talking about, well, risk analysis and when it comes to 12 12
risk analysis, or really any concept that we have to really understand and be able 13 13
to apply it to our certification exam, we have to start with some of those concepts. 14 14
So, Adam, when it comes to the concepts, in general, where do we get started? 15 15
>> Wes, that's really great. 16 16
I call these things the must know risk terms. 17 17
Join me, let me show you what my list looks like as we get started. 18 18
Remember, this is not an exhaustive list, but 19 19
these are very important vocabulary terms. 20 20
Terms that come to you has suggested, nudge, nudge, wink, wink that 21 21
you may wanna be aware of with regards to synthesizing and applying for the exam. 22 22
Now Wes and I and Daniel and Wes more broadly across the course and 23 23
mentioned one or more of these terms, either in passing or formally define them. 24 24
We already mentioned the idea of the risk matrix and 25 25
this idea of how we track risk in one or more episodes so far. 26 26
I mentioned risk appetite in the last episode as we were rounding out. 27 27
Talking about the ways in which we can mitigate risk as one of 28 28
the accepted ways of addressing risk. 29 29
We've talked about risk awareness broadly, we've talked about residual risk, 30 30
I made a big deal about defining that, 31 31
talking about the faculty of no such thing as a zero sum risk solution. 32 32
So let's tighten up our definitions here for just a couple of minutes. 33 33
But keep in mind, 34 34
terms keep bubbling up time and again, it's probably important take note of them. 35 35
The risk register is in many respects the ledger. 36 36
It's the formal documentation of risk in the organization, 37 37
what are all the risks that we have, understood, identified and 38 38
that we are tracking and managing and/or that we have retired, if you will. 39 39
So it is our definitive formal guide that helps us to keep track of risk. 40 40
Now this can vary by organization that looks and feels differently. 41 41
Some of my customers literally have a register, they write stuff down. 42 42
Others have online software portals as part of their configuration management and 43 43
release and 44 44
deployment management capabilities that track these risks for them. 45 45
Their help desk or 46 46
service desk software will incorporate this as part of their knowledge base. 47 47
I've seen it done a lot of ways. 48 48
There's no right and wrong here. 49 49
I mean it's wrong would be to ignore risk and pretend it does not exist. 50 50
Because it does and it will as we have established the initial for 51 51
you if you choose to potentially, and let me be clear, 52 52
I'm not suggesting that avoiding risk is not an accepted methodology for 53 53
dealing with it, cuz we have established that it is. 54 54
What I'm suggesting to you is sticking your head in the ground and pretending it 55 55
does not exist and not eyes wide open, taking steps to acknowledge it and 56 56
then choose to decide that you're formally not going to engage in those behaviors 57 57
that would lead down the road to those risks is a very different approach. 58 58
And we need to make sure we differentiate there. 59 59
Risk matrix, sometimes also and/or referred to as a heat map of the risk 60 60
matrix allows us to plot out, Wes talked about this and brought it up over one or 61 61
two of our conversations in the last couple of episodes in one way or another. 62 62
He didn't formally call out the idea of the risk matrix. 63 63
But his comments really were aligned with this idea that we understand and 64 64
measure risk and therefore can plot it. 65 65
And you even came out and said, 66 66
some of those really highly impactful- >> Sure. 67 67
>> It may not happen as often in terms of likelihood but if impact is high, we have 68 68
to know that because we still have to take steps to address that risk because when it 69 69
does happen, it's gonna hurt us while the risk matrix allows us to visually lay that 70 70
out and understand that, and it can be done in a variety of ways, right? 71 71
>> You know, one of the things you've constantly told our viewers is to kinda 72 72
put it in your own words I think of that risk matrix is severity and 73 73
probability matrix, how severe is that likelihood just another way, 74 74
probability another way to say likelihood. 75 75
So remember, make the term your own so 76 76
that you could apply it to the concepts that you know on the exam. 77 77
>> And remember also and I like the way you interchange likelihood and 78 78
probability, severity is impact. 79 79
>> Mm-hm. >> Right? 80 80
>> That's right. >> About just the sunanda, the synonymous. 81 81
>> [LAUGH] >> Synonymous thought process cuz 82 82
you often see many risk matrices done with probability and impact. 83 83
So we just wanted to call pie charts more often than a probability impact exposure, 84 84
is what the acronym stands for. 85 85
And so you wanna make that connection, 86 86
like the way Wes set us up to think about that. 87 87
So the idea of how we visually represent that, low, low, low, medium, medium, 88 88
high, high, high, that kinda thing about impact as well as likelihood. 89 89
Risk control assessment and/or self-assessment of risk, how does 90 90
the organization either from an external perspective or an internal perspective 91 91
done by yourself, meaning within the organization self-assessing and/or 92 92
third parties brought in to formally assess an audit our risk controls. 93 93
And give us an understanding of their impact and ultimately their efficacy, 94 94
how important are they but also how appropriate are they? 95 95
Two very important things to consider. 96 96
The risk control assessment helps us to understand that. 97 97
We've talked about risk awareness. 98 98
This is a subset of security awareness overall, and 99 99
[UNKNOWN] every organization that focuses on security and information security 100 100
is going to be very big on awareness and awareness training in the probability of 101 101
that impact being very important to mitigate risk cannot be understated. 102 102
As in it's usually a good answer on the exam. 103 103
If you're [LAUGH] asked, 104 104
risk appetite is the measure of risk tolerance in the organization. 105 105
How much risk are we willing to tolerate, to accept and to operate with knowing 106 106
full well that that risk may at some point come back to hurt us? 107 107
Very important. 108 108
Inherent and residual risk, inherent risk is the risk that is in something that we 109 109
are doing, it is built in, we have to know it is there. 110 110
And residual risk is the risk that is left over after we apply controls and/or 111 111
counter measures to, in some way, address risk, is the risk that is left behind. 112 112
So these are the beginning terms that we wanna think about as we begin to 113 113
understand really frame out our conversations around how we analyze risk, 114 114
but remember, analysis of risk doesn't happen without assessment of risk. 115 115
I was having this conversation with Wes before we started, 116 116
you've gotta understand and frame risk through assessment, measurement and 117 117
quantification and qualification to then put it into terms that we can examine and 118 118
analysis is about the examining. 119 119
Assessment is about the defining, we must define before we analyze, 120 120
it's very important. 121 121
It's a thought process. 122 122
>> All right, Adam, so now that we've got some of the terms ready, 123 123
one of the things that we have to be aware of, we've kinda already talked about but 124 124
then a little bit of a reminder here, can you kind of maybe tap into something that 125 125
we've learned in a previous episode and 126 126
how it relates to our current endeavors and that is the risk assessment process. 127 127
>> Absolutely, when we think about risk assessment, 128 128
I just mentioned that assessment is about defining and 129 129
analysis is about the framing, the understanding of what we are seeing. 130 130
We talked about, West and I spent half of our last episode talking about risk 131 131
assessment and the formal NIST process. 132 132
NIST SP 830 R1 page 23. 133 133
We're not gonna go back through it here. 134 134
We spent a lot of time on and encourage you to go back, take a look at that other 135 135
episode, here, wasn't I go through this in excruciating detail, but 136 136
it's really important for you as we look ahead to analysis of risk, 137 137
making sense of what we are seeing is what analysis helps us to do. 138 138
Well, we don't see anything unless we assess first. 139 139
So begin the process correctly. 140 140
Understand the value of assessment to lay out and define and 141 141
tell us what the risks are likely to be. 142 142
And then we will analyze that output, explaining and identifying those areas 143 143
that we have to focus on which is what analysis if done correctly, 144 144
will help us to do. 145 145
>> So, when we do an assessment, we've got a couple of different methodologies or 146 146
formulas if you will, that we can use. 147 147
And you've mentioned them in previous episodes. 148 148
But here's a good point where we can go a little bit more in depth and 149 149
kind of peer back the veil and have a deeper understanding of it. 150 150
Let's talk first about what's known as the quantitative risk assessment. 151 151
What do we need to know about that Adam? 152 152
>> So when we think about the quantitative formula, or a quantitative risk assessment 153 153
approach the formula, we'll share with you in a minute. 154 154
I wanna first define the concept of quantitative analysis of risk and 155 155
what that entails the assessment and analysis of risk and what that entails. 156 156
Quantitatively looking at something means to measure the tangibles. 157 157
It's typically as I've talked about in prior episodes, 158 158
a numerically driven assessment. 159 159
So we are understanding something based on looking at it and 160 160
saying on a scale of one to five, one being low, 161 161
three being medium, five being high, how impactful is this? 162 162
And we assign a numerical value that's quantitative. 163 163
We often spin quantitative by giving it a dollar value because we wanna 164 164
understand the impact not just simply on a one to five scale, but 165 165
rather how much money is this gonna cost us? 166 166
So we will say, this particular issue that's happening costs us a hundred US 167 167
dollars just to keep it simple for purposes of our conversation, or 168 168
the equivalent in any currency, wherever you are in the world, right? 169 169
And it's gonna cost us a hundred of your dollars every time this happens. 170 170
If it happens five times over the span of time we measure, it's gonna cost us $500. 171 171
Well, okay, now I know several important things. 172 172
I know what it costs every time it happens. 173 173
I know the frequency of occurrence as well as the individual cost per occurrence. 174 174
Those two things. 175 175
I now have the all up cost over the measure or quantifiable period of time. 176 176
And I can then make some educated discussions happen and 177 177
engage in them around whether or not we should invest money to achieve some 178 178
sort of mitigation of that particular activity through a control being applied, 179 179
because now we can assess the control and its cost. 180 180
Well, the control is gonna cost $500 but so 181 181
is the impact of this over the measurement span of time. 182 182
Essentially it's gonna cost us the same amount of money whether I go ahead and 183 183
mitigate or I just let it happen. 184 184
But the quantitative impact is not the only thing we have to look at it. 185 185
We also have to understand the qualitative impact. 186 186
What is the qualitative measure? 187 187
Well that's a soft measure, not tangible, not numerical. 188 188
But rather based around perhaps our assessment of our ability to maintain our 189 189
customers in the face of these ongoing attacks that are costing us money. 190 190
Maybe it's our reputation, maybe it's the perception in the mind of our customers 191 191
that we're no longer trustworthy. 192 192
And as a result of not being trustworthy, they may take their business and 193 193
go elsewhere. 194 194
And now it's not just a $500 loss, it's multiplied by the number of customers we 195 195
lose, the amount of revenue each one would generate. 196 196
Let's keep it simple. 197 197
Let's say each one is worth $10 and we lose 1000 customers. 198 198
That's $10,000 plus 500. 199 199
That's a lot more than just 500. 200 200
And so quantitative is just that dollars and cents numerical measure. 201 201
Qualitative is really about this idea of the soft or 202 202
intangible costs that can also be very important. 203 203
Now we're gonna focus on the quantitative assessment here for a couple of minutes. 204 204
But I think it's important to lay both out just as a high level definition before we 205 205
get into this. 206 206
So we've laid out both quantitative and qualitative. 207 207
Now let's put up what I referred to as this form. 208 208
I didn't actually give you the formal formula, but 209 209
I actually explained the entire form and gave you all the parts. 210 210
And if you're familiar with it, you probably recognize what I just said, 211 211
which is annualized loss expectancy, what we call ALE, A-L-E, 212 212
is made up of two components, single loss expectancy. 213 213
S-L-E pronounced SLE, multiplied by, that's little asterisk or 214 214
star there, multiplied by A-R-O or Annual Rate of Occurrence. 215 215
And I said, well, we know if it costs $10 every time it happens, 216 216
and it happens ten times, it's gonna cost us $100 over the measurement period. 217 217
I know those are different numbers from the ones I used just a moment ago, but 218 218
the numbers don't matter. 219 219
We're just simply plugging them in to the formula. 220 220
Well, it costs $10 every time it happens, that's single loss expectancy. 221 221
Annualized Rate of Occurrence, let's say over 12 months, 222 222
one year, okay, no problem. 223 223
$10 every time it happens, the rate is not 12 months, that's the measurement of time. 224 224
That's the annual in annual rate occurrence. 225 225
How often is it happening, is what ARO represents. 226 226
Well, it's gonna happen 10 times over that span. 227 227
ARO is 10, Single Loss Expectancy is also 10, 228 228
$10 versus 10 times multiply 10 times 10. 229 229
Annualized Loss Expectancy, ALE is $100. 230 230
And so we simply manipulate the values to run them through the formula. 231 231
Now this is our accepted formula for quantitative risk assessment. 232 232
Very important for you to know this formula, understand how it works. 233 233
And to be able to run the numbers so to speak. 234 234
And to that end, you have to not only understand the overall formula, 235 235
but SLE, Single Loss Expectancy is actually derived very 236 236
specific ways as you just saw on the next slide. 237 237
You have to understand how SLE is actually going to be found or solved to for. 238 238
There's a separate component to the formula. 239 239
SLE is actually made up of two distinct values that are multiplied together 240 240
as well. 241 241
Asset value multiplied by exposure factor. 242 242
Now I gave you the value of SLE in my example just a moment ago when I said, 243 243
well, it's $10 every time it happens. 244 244
But I didn't really tell you how I figured out it was $10. 245 245
I just made up a number and said it's $10. 246 246
You don't know if Wes handed me a piece of paper that had the number 10 on it, or 247 247
if he held up a $10 bill, or if I just made that up. 248 248
All you know is that I gave you that number. 249 249
But the way I actually derived that number is by using this formula. 250 250
And let's just put up the definitions of these two elements so 251 251
you can understand what they are. 252 252
And I then in my mind quickly said well, if I want this kind of a number, 253 253
what's my asset? 254 254
What is the thing that's being affected that has value to the organization that we 255 255
want to apply the control or countermeasure to? 256 256
What is my asset's value to the organization? 257 257
Well, my asset's value to the organization is $100 in my estimation in my mind. 258 258
What is the exposure factor? 259 259
That is the percent of loss that would be experienced if a specific asset were 260 260
to be attacked. 261 261
The asset we're valuing is the asset we're talking about. 262 262
I specified in my mind as I generated that value for SLE, that exposure 263 263
factor which is always a percentage by the way, very important to note that, is 10%. 264 264
So if it's $100 for the asset value times 10% for exposure factor, 265 265
I then get $10 dollars because 1/10 or 10% of 100 is gonna be $10. 266 266
So that in my mind is the calculation I engaged in 267 267
really quickly to generate that value for SLE. 268 268
And then by doing that and plugging it into the formula. 269 269
Just like right here, I'm able to go ahead and 270 270
say SLE is $10 made up of asset value, $100 times exposure 271 271
factor 10% that generates or derives a value of $10. 272 272
Again, localized in whatever currency it doesn't matter. 273 273
My annualized rate of occurrence was 10, 274 274
multiply $10 times 10 SLE times ARO, I get $100. 275 275
My annualized loss expectancy is $100. 276 276
In my example, based on the numbers we've been working with for 277 277
the last several minutes. 278 278
Now it's important for you to be able to do what I just did, 279 279
to be able to be given a word problem, be given one or more. 280 280
You need at least two in some way, of the elements that you have to use and 281 281
solve for the third. 282 282
You may simply be given the SLE value and be asked, how did you derive SLE? 283 283
Asset value times exposure factor, you may be given asset value and 284 284
exposure factor and asked to work out what SLE would be? 285 285
You may be given SLE and ARO and asked to solve for ALE. 286 286
You may be given ALE and ARO and asked to solve for SLE, 287 287
in other words, it's two out of three times right? 288 288
And as long as we give me two out of three you should be able to substitute and 289 289
solve for the third, right? 290 290
That is just a pretty basic set of skills, 291 291
that we expect you to bring to the table with regards to this kind of exercise. 292 292
So, definitely walk back through this, 293 293
make sure you understand the logic of how the numbers work. 294 294
Make sure you understand how to derive SLE and know that formula. 295 295
Make sure you understand, how we get this entire formula to come together, and 296 296
that we use those pieces right, in order to be able to move forward and 297 297
come up with an assessment. 298 298
And this is important, let me just move back through the slide here really 299 299
quickly, back to where we were. 300 300
This is important because now we can access, we can understand through 301 301
analysis, and this is where the analysis is about to come in. 302 302
We can understand whether that $100 value for ALE, 303 303
that we just came up with, $10 multiplied by 10 occurrences over 304 304
the measurement period equals $100, as our annual loss expectancy. 305 305
Well, okay, that's good, what does that really mean? 306 306
Well, it can be one of three things. 307 307
If our countermeasure is less than the annual loss expectancy, 308 308
our countermeasure is $80, our annualized loss expectancy is 100. 309 309
Well, we should do this, we're spending less money on the countermeasure. 310 310
We're actually netting $20 and saving our reputation probably in the process. 311 311
So quantitatively it's a good deal, qualitatively it's a good deal. 312 312
What if the countermeasure is equal to ALE? 313 313
We're gonna spend $100, if we do nothing cuz it's gonna hurt us, 314 314
it's gonna cost us $100 in annualized loss expectancy. 315 315
We're gonna spend $100 for the countermeasure, if we try to mitigate it. 316 316
Spending the same amount that we would lose is still a good deal, cuz again, 317 317
qualitatively, it's gonna help us with our customers, 318 318
we're less likely to lose that $10,000 in additional revenue, may walk out the door. 319 319
So it's still a good deal. 320 320
What about if the countermeasure is greater than ALE? 321 321
It's gonna cost us $200, to stop this problem as a countermeasure being applied. 322 322
It's going to cost twice what the problem itself actually will cost. 323 323
So we just step away and say, all right, no problem, hey, guess what? 324 324
Do this as often as you want to, 325 325
it's still gonna cost me less money than if I buy the countermeasure. 326 326
What does it say there? 327 327
Doesn't say don't do it. 328 328
It says think before acting, because there are qualitative issues we have to address. 329 329
In the minds of our customer, if we don't spend this money even though it's more 330 330
money than the actual financial impact of letting it happen. 331 331
That's gonna amplify the concern in their minds, they're likely to go elsewhere. 332 332
Maybe all our competitors are doing it, and we don't have a choice, 333 333
we have to do it anyway, even though it makes no sense for us to do it. 334 334
Maybe there's a regulatory or statutory issue, we have to do this or 335 335
we're gonna get fined. 336 336
And so we just got to spend the money because it's the cost of doing business. 337 337
So this is where our analysis comes in, and where we need to understand the value 338 338
of what a quantitative assessment can tell us. 339 339
Remember, assessment measures and gives us the understanding, 340 340
analysis lets us look at that and derive meaning. 341 341
And these two together are incredibly powerful tools. 342 342
>> One of the things that you have brought in there that you say and I think about, 343 343
some of the residual things that if you don't have dollar amount on it. 344 344
You said customers, 345 345
like maybe leaving your company going to another company, right? 346 346
So maybe you can't recognize the dollar value, but 347 347
how do we what we do that if we're worried about things like reputation, right? 348 348
I don't have the reputation. 349 349
Our customers don't really have faith in you, being able to stay with you, so 350 350
they do go to those competitors. 351 351
>> They can, they may or may not. 352 352
Right obviously, it's hard to say what will happen. 353 353
But, we can theorize, we can summarize that and say it's very likely other 354 354
competitors in our industry have had this happen, customers have left them. 355 355
And if we don't take these steps, it's likely they'll leave us, right? 356 356
So, that's very true. 357 357
And remember, we talked about qualitative risk assessment. 358 358
I defined it earlier, but we didn't bring it up and we spend time on, 359 359
I just wanted to end our conversation. 360 360
By reminding you of the definition of qualitative. 361 361
Let me talk about it several times, measures the intangibles, right? 362 362
The product of likelihood and impact produces the level of risk. 363 363
That's what we're thinking about here. 364 364
Is it gonna happen, how likely is it if it does happen, 365 365
how likely will it be that it hurts us? 366 366
And these are more qualitative than quantitative. 367 367
The higher the risk level, the more immediate the need for 368 368
the organization to address that issue. 369 369
We talked about this using the risk matrix. 370 370
And remember, it's not just about the numbers, 371 371
it's about the perception as Wes just reminded us in the minds of our customers. 372 372
Something may be incredibly high impact, even though it's low likelihood. 373 373
That doesn't mean that we don't address it. 374 374
Because when it does happen, our customers are gonna blame us for 375 375
not being the company that said, well, we're gonna take advantage of it 376 376
not happening now to plan and prepare, and be ready, right? 377 377
Because it's gonna happen, it's just a matter of when as opposed to if. 378 378
And even if it's an if, customers don't like surprises, right? 379 379
Let's just think about it that way. 380 380
None of us probably are really wild about surprises, when 381 381
it comes to highly disruptive activities like risk, and if we can avoid those and 382 382
mitigate the impact by planning, then shame on us for not preparing better. 383 383
And that's what qualitative helps to remind us that we have 384 384
to take into account, we have to be aware. 385 385
>> All right, ladies and gentlemen, there you have it the language and 386 386
the formulas behind risk assessment and risk analysis. 387 387
That's all the time that we have for this episode, but stay tuned, 388 388
cuz we got more to come in the security plus series. 389 389
>> Take care everybody. 390 390
We'll see you soon. 391 391
[MUSIC] 392 392
>> Thank you for watching, ITProTV. 393 393
[MUSIC]