- [Instructor] We'll continue our discussion
on risk management
by talking about risk management framework
and vulnerability management.
So our goal for this lesson
is to define what risk management framework is.
We'll talk about vulnerability management
and how it correlates with risk management.
And finally, we'll describe security testing,
which is related to both of these concepts.
So we already talked about risk management
and the steps of risk management.
Let's now talk about risk management framework.
So first I'll define what we mean
by risk management framework.
So risk management framework
is basically just like any other framework.
It is basically a system
or set of steps defined by NIST.
And they have defined this framework
in their publication 800-37r2 for revision 2.
This is also known as the RMF or RMF framework,
even though F stands for framework.
So basically what it does is that
it provides you with a step-by-step guidance
as to how you should implement risk management
in your organization.
Keep in mind that this directive is used by US Government,
mainly in the federal space.
And this was developed for US Government
to operate all the organization
that is part of the government,
such as, you know, your energy department,
your state department and so forth.
And any organization that directly works
with these organizations are also part of this framework.
However, this has become such a comprehensive guideline
that it has now become industry-wide best practice
for implementing risk management.
So this framework is not just for US federal government,
it is now used industry-wide.
It has org-wide risk management implementation steps
that relates to your information, security,
privacy, different types of system elements,
who should have different types of access and control,
privacy posture, security posture,
as well as supply chain-related risk.
So let's now talk about the implementation step
related to this particular RMF.
So, the steps here are very similar
to the risk management implementation steps
that we talked about in our first lesson.
However, it is a little bit more elaborate.
So first step is to prepare,
where we basically identify our vulnerabilities
and discuss our threat source
or list down our threat source.
It is adding one more step after that,
which is categorize.
So basically categorization will help us to understand
what are these different types of threat source are,
and also to identify where we should focus first.
So, categorization actually helps us in terms of planning,
preparation, as well as implementation.
After you categorize,
you have to select what you are going to implement first.
After you're done with that selection process
comes the implementation.
So once implementation is done,
then you have assessment.
In the assessment step,
very similar to what we have done before,
we are using different tools and different methodology
that is applicable for your different components
just to make assessment as to what are the risks.
And finally, you have authorization
for reviewing these assessment results
as well as taking some mitigation steps.
Last but not the least,
we talked about this even in our first lesson,
that we will continue to proactively monitor the system
just to see what type of risks that are arising,
perhaps from introducing
anything new component to your system,
as well as new external risks
that are coming up almost every day.
Let's now dive into vulnerability management.
So vulnerability management means that proactively,
we are identifying, assessing,
and prioritizing potential security vulnerability.
And this vulnerability can be related to application,
any data or database, or our network.
Now these may seem very similar to risk management.
Now keep in mind that risk and vulnerability
are not necessarily the same thing.
You can have a very robust system,
but still you need to do risk management
even if you have addressed all the vulnerabilities
that are currently present within the system.
Because risk management is a much more proactive step
as well as risk management,
the implications are much broader
as we discussed
in our compliance-related presentation as well.
So risk management
is a much broader type of proactive process,
whereas vulnerability management is,
you can think of as a part of risk management,
which is the goal of this particular step
is to only focus on the vulnerability,
also known as the weakness within the system.
So what are vulnerabilities?
So for example, if you have a application
and perhaps that application uses some system account
and you are not able to implement MFA,
or anything for that system account,
then how do you secure that system account, right?
So that is a vulnerability
or weakness within that application.
You need to figure out a different way.
Perhaps you use certificates
or something else to protect that system account.
Same thing goes with data.
Just you know, perhaps you have certain data
that absolutely needs to have much broader access,
so how do you protect that data?
So it's a proactive process that you are continually doing
to find weaknesses within the system.
And the way to do it
is to use some sort of vulnerability scanner.
One of the main goals of vulnerability scanning
is to make sure that you discover all your assets,
so you don't have like you know, any,
there are a lot of fairly large organization
that have like, you know,
some what we call a homegrown application
or maybe a small database hanging out somewhere,
which is not actually protected.
So make sure that you identify everything
and report everything,
so that you can take action.
So let's dive into the vulnerability scanning.
This is a process of checking your system for weaknesses.
What the scanning does is that
it checks the security level.
So you may have already implemented complex password
for your users, but have you implemented MFA?
Now you may have implemented MFA,
but maybe you are better off implementing MFA
with biometrics,
or maybe even with MFA,
you are better off doing some sort of geo-fencing
where you only have access to the system
from certain geographical location.
So it finds those type of weaknesses within the problem
and it offers you a solution
or suggest you certain solution to remediate the situation.
So vulnerability scanning usually are two different types.
One is general scanning,
which gives you overall a general type of recommendation.
So for example, if it finds the account,
it just says okay, you need to do multifactor.
Whereas application specific one
will actually understand what type of account it is
and it'll provide you alternate solution.
So there are some pros and cons
in terms of doing vulnerability scanning.
Of course we want to always do vulnerability scanning,
but it is good to know some of the disadvantage
that comes with vulnerability scanning.
So the advantage, we already talked about it,
that it is a proactive process
that you are supposed to be doing on a regular basis
to figure out what are the weaknesses within your system
and take remediation steps.
And more often than not,
since it is a weakness within the system,
it's not like reducing risk,
it's rather you know that it is a risk
and you have to take action,
you should do it immediately.
And more often than not,
vulnerability scanning comes with
very advanced security tools,
it becomes a automated process.
The con or the disadvantage of vulnerability scanning
is that sometimes it can throw false positives.
So for example, it can just say that,
oh your, you know, this particular account is in danger
because a user who is always logging in
during normal business hours
is logging in on weekends more frequently.
So oftentimes if this basically vulnerability scanning tools
establish a pattern
and then if they see user or application
working outside that pattern,
it'll throw in false positives.
So just be aware of that.
It also has what we call a crash exposure.
So basically what it does is that
oftentimes because the way it is scanning
is that it can be a bit intrusive
and that can cause certain application to crash.
Although the more modern
the vulnerability scanning tool gets,
this is less and less.
And last but not the less is that
vulnerability scanning oftentimes are not able to scan
or understand temporal information.
Let's talk about testing security monitoring system.
We talked about a lot of different tools
using tools to do your assessment
to your vulnerability scanning.
But are these tools actually working properly?
You should test to ensure the reliability
and compliance of the tool.
So you maybe have configured a tool for certain compliance,
but it is possible that due to regulatory changes,
your organization is now subject to additional compliance.
So if you don't actually test
or review the configuration of your tools,
you may not have even configured your tools
for this new compliance.
So make sure you are constantly are reviewing
and calibrating your tool,
or reconfiguring your tool,
or you know, different purpose regulatory.
It can be regulatory compliance,
it can be that you never use SQL server,
now you have a SQL server in your environment,
so you have to configure your tool for that.
So the testing that you should be using is, you know,
check data patterns with single packet testing
or multiple packet testing.
These are usually built into the tool,
so you don't actually manually have to do that.
And this will just show like, you know,
what is going on in your network.
So in other words, if you are the security administrator,
you may not be even aware in a large organization
what type of database,
let's just say your application developers are using
or installing.
But if you do different type of packet analysis,
you will know.
So you should look at different types of data as well
just to understand what is happening.
You can do protocol embedded attack type of monitoring,
and also you can also see, you know,
what is going on in your environment,
any type of vulnerability by flooding detection.
To summarize,
we talked about risk management framework by NIST.
We talked about vulnerability assessment.
And last but not the least,
we talked about testing your security system.