(upbeat music)
- Risk is an essential part of doing business.
Whether it's taking a risk on a merger or acquisition,
taking a risk that purchasing new equipment
will be a cost effective investment
or whether there's sufficient plant protection
to avoid injuries to workers.
Management needs to understand their level of risk exposure.
And make sure that it's within their risk appetite.
Cybersecurity is at its heart the management of risk related
to internet connected businesses.
This includes the threats of hackers and malicious software
entering from the internet,
the vulnerabilities of internet facing it systems
and the attack countermeasures or controls.
All of which affect how successful the business will be
in meeting its desired outcomes.
A standard approach to managing risk has been developed
by the National Institute of Standards and Technology.
And its application is described in special publication
800-30 Guide for Conducting Risk Assessments.
The International Standards Organization
also provides guidance with its ISO 27,005
Information Security Risk Management publication.
While there are minor terminology differences,
the intent of both documents is the same.
Risk starts with a threat event which must be analyzed
to determine the likelihood that the event will occur.
This is done by considering the likely threat actors,
there capabilities and there resources.
The intent or motivation needs to be considered.
What is it that drives this threat actor
to want to Mount an attack?
An attacker will only attack if the results outweigh
the cost of attacking.
And that depends on the value of the target
to the threat actor.
This could be financial gain,
obtaining intelligence, disrupting services
or just peer recognition.
The next thing to think about is the set of vulnerabilities
in the information and processing assets.
The databases, workstations, servers and networks
which this event can exploit to cause damage.
For instance, a data center in the basement of a building
may be vulnerable to a flood event.
A website may have a software vulnerability
which can be exploited.
A server without an uninterruptible power supply
would be vulnerable to a power outage.
However, not all vulnerabilities are equal.
A flood may be catastrophic with the whole data center
out of action for weeks.
Whereas an attack which exploits a website floor
may just be a nuisance.
The next thing to consider is the impact to the business
of an event.
This is typically done by carrying out a business impact
assessment to determine what systems will be affected,
how this flows on to business processes
and the cost of service degradation or failure
to meet critical levels of performance.
Being able to describe a security event as a business impact
is a powerful way of gaining the attention and the respect
of the business and being able to get a well balanced
business decision on what to do about the threat.
Controls may have been put in place to protect the assets
and their effectiveness needs to be considered
for each of the feasible threat scenarios.
This will then allow calculate of the overall risk.
The cyber security risk management program starts
with sourcing threat intelligence.
Let's have a look at some of the sources
of threat intelligence.
A useful catalog of strengths can be found at appendix E
to the NIST special publication SP 800-30.
This catalog provides representative examples
of threat events expressed as tactics,
techniques, procedures or TTP's.
Another very useful source of TTPs is the MITRE attack site.
Which is used in Mitre cybersecurity resiliency framework.
VERIS provides an open community threat database
which can be used to support risk analysis.
ThreatStream offers an open source cyber intelligence blog
which reports on contemporary activities and threat actors.
There are a number of good sources of specific threat
reports which provide detailed information on threat actors,
threat techniques and target vulnerabilities.
Here we see a report from BAE systems applied intelligence
on a vulnerable application called MacKeeper
that can be exploited to attack Mac OS systems.
There are four possible treatments once an assessment
has identified the risk.
Risk acceptance,
where the risk is within the businesses appetite.
Risk avoidance,
where it's better to stop doing that line of business
than take the risk.
Risk transfer, where a third party takes the risk
such as insurance to cover risk should it eventuate.
And risk mitigation,
where controls are implemented to reduce risk.
Risk mitigation and the protection of business outcomes
which they provide means implementing controls
in the form of cybersecurity policies, procedures
and technical solutions.
There are four key types of control that can be applied.
And it's generally recommended that two or more
are used together to achieve defense in depth.
The first is deterrent controls.
These reduce the threats.
An example of this is incarceration,
which deters would be criminals
from carrying out their attacks.
Preventative controls are designed to stop the attack
from succeeding by not allowing it to get it an asset
to exploit a vulnerability.
A firewall is one such preventative control.
Blocking protocols that might be used as attack vectors.
Detective controls are use to detect that an attack
has taken place.
A burglar alarm is a typical detective control.
Finally, corrective controls are used to reduce
the impact of an incident.
A good example of this being recovery from data backups.
The NIST cybersecurity framework presents corrective
controls as the respond and recover functional control.
(upbeat music)