Hi, I'm Jeff Crume.
I'm an IBM distinguished engineer.
And in a previous video I talked to you about Zero Trust, and I concluded with the notion that risk analysis should inform our Zero Trust decisions.
So to extend that, let's think about a thought question - - Why do you put brakes on a car?
Seems like an obvious enough question.
Everyone says so you can stop.
Let me suggest to you it's so that you can go really fast.
And if you don't believe me, then think about how fast you'd be willing to drive a car that had no brakes.
The answer is you wouldn't.
You wouldn't even get in the thing.
So ...
what the brakes do for us?
They allow us to take calculated risk as opposed to a wild, un-calculated risk.
So they're the thing that allow us to control our risk.
Now let's think about that and apply that to organizations and individuals and how we perceive risk.
For instance, some people when it comes to travel will say, you know what, I don't like getting in airplanes.
I'm going to take a train everywhere I go.
If it takes me four days to get from Chicago to San Diego and four days back, that's what I want to do, because that's my tolerance for risk.
Someone else like me doesn't mind flying 4 million miles in the air.
Okay, so I'm willing to get in the plane.
But what I won't do and where I draw the line is getting out of the plane before it's on the ground.
In that case, I'm going to say I'm in the middle on the risk tolerance.
But then some people are willing to say, you know what, with a parachute, I can get out of this perfectly good airplane and I don't have to wait for it to come down to the ground.
Three different tolerances for risk.
Three different risk profiles.
Now, what does that have to do with this subject?
Well, organizations are the same way.
You could take a bank and it might be very risk averse or another bank in the same industry might be much more tolerant to risk.
So when we're making our security decisions, we have to consider what is our tolerance for risk to begin with.
So to illustrate that, what would it look like as an example?
Well, if we have for instance, here is a user who is going to hit our Web server.
And a more risk tolerant organization might say, I'm going to put a firewall in front so that I have some level of protection.
Good enough job done.
Now, another organization might look at the very same set of issues, the things that we're trying to do and might say, No, I'd like a little more protection.
I'm going to put my Web server here, but I'm going to make a separation between the web server and the data, the database in particular, so that I can add another layer of security.
Another firewall.
A second firewall, so that now if there is a bad guy trying to get in, he has to traverse two security zones in order to get there.
More protection.
More averse to risk.
However, some organizations like The Train Guy are going to look at this even more risk averse.
And they're going to say, what I want to do is even more separation.
I'll put my web server here, an application server behind it, and separate the data from the application.
So now I have a path that looks like this.
Now I have a traditional DMZ for the web server.
That's just the presentation services.
The application itself is protected from the web server and the data is separated from all of it.
So which one of these is the right answer?
Well, it all depends.
It depends on a lot of things.
It depends on your tolerance for risk, your organization's tolerance.
Is your organization a train, a plane or a parachute?
It also depends on cost.
If this is too expensive or the type of data that I'm trying to protect isn't worth that level of protection, then I would scale back to one of these others.
So there's a lot of considerations that go into this.
And if you want more help, we have some resources linked down below where you can see IBM can help in guiding these decisions.
Thanks for watching.
Please remember to like this video and subscribe to this channel so we can continue to bring you content that matters to you.