- [Instructor] So, how do you get your boss or a customer
who's an asset owner to make a decision
about an IT risk that you've identified?
In my experience, the following approach works for 90%
of the people who try it 90% of the time.
First, using ordinary business language,
explain the impacts in terms of dollars
or in terms of degraded metrics to the asset owner's area
of responsibility if the IT risk materializes.
Then, explain the risk treatment options
along with the costs that would effectively reduce the risk
so that it's within the organization's risk tolerance.
If you suggest controlling the risk,
you'll also need to suggest one or more mitigations.
Now, when you design these mitigations,
make sure they are minimum viable.
And by this, I mean that the mitigation provides
just enough capability to reduce the risk
while minimizing the implementation and operations costs.
Let me give you an example of what I'm talking about.
Let's say you're working on the InfoSec team.
And in a casual conversation,
you discovered that the sales team's current working files
are stored on their laptops and are being synchronized
with the cloud service so that the files
can be accessed anywhere.
You know that their data is at risk
because there is a very low likelihood
that a typical cloud synchronization service
will provide data recovery in the case
of a ransomware attack.
So realizing that sales, deals in progress
would be seriously delayed
if a ransomware infection happens,
you believe that would violate
your employer's risk tolerance.
So now you realize you have to say something
to the sales team.
Here's how I would present the IT risk decision
to the asset owner, in this case,
the vice president of sales.
Hey, Nicole, I've got an IT risk you should know about,
and it concerns your team's sales data.
Your team members are constantly opening files
attached to emails that they get from various people.
And I realize that's part of their job,
but that means they're at high risk
for a ransomware infection,
which would encrypt all their files
and keep them from closing deals on time.
Now, if ransomware happens,
it could cause a four to six-week delay
on all your open deals,
and I'm concerned that would cause you
to miss your quarterly sales targets by about 30%.
Now, I know that you're using a file sync tool
with the cloud, but that doesn't provide
reliable ransomware protection.
So here's the thing,
your team needs to continue to open unexpected files,
so I don't know that there's any way
that we could avoid this risk.
And while I know you may want to accept this risk,
there would be a very big financial impact
if ransomware did happen,
so I'd have to escalate this to my boss
if you wanted to go that route.
But I have an idea.
Let's control the risk using
a ransomware resistant data backup strategy.
It's called the 3-2-1 strategy.
Now, we'll need to have at least three copies
of your team's data, including their working copy.
So we'd keep the two copies they're using now,
the ones on their local hard drives
and the ones in the cloud.
But now, let's add one more copy that will be saved offline
just in case ransomware happens.
I think we can do that for a very reasonable cost.
And the IT team would handle all the details.
What do you think?