All language subtitles for 003 Risk Handling (OBJ 1.2)

Instructor: When we talk about risk, we have to think

about what we can do about risk as an organization.

After you conclude your penetration test,

one of the biggest deliverables you're gonna have

is a final report to your client's organization

that lists all the vulnerabilities you found,

how they were exploited,

and what controls the organization can add

as mitigations to minimize their risk exposure.

In every risk management program

there are essentially only four things you can do with risk.

You can avoid it, you can transfer it, you can mitigate it,

and you can accept it.

Risk avoidance is a strategy that involves stopping

a risky activity or choosing a less risky alternative.

But how does this apply to our IT networks?

Well, let's assume that we have a network

currently comprised of a hundred computers,

but 15 of those are running Windows 7.

If you know anything about end of life

and unsupported software, you already know

that Windows 7 stopped receiving official support

back in January of 2020.

To avoid the risk of running an unsupported software

like Windows 7, we really only have two choices.

We could take those computers offline,

meaning we stop that risky activity,

or we can upgrade those computers

to Windows 10 which is a newer

and still supported operating system

and thereby is a less risky alternative.

Now, when we talk about risk avoidance

we're basically eliminating the hazards, activities

and exposures that could negatively affect us.

For example, in my own company,

we ended up choosing risk avoidance

for our CompTIA Exam Voucher Sales Program.

We saw a sharp increase of fraud from people

buying our exam vouchers using stolen credit cards.

In just one month, one out of every two exam vouchers

that we sold, ended up being disputed as fraud

by the victim's credit card companies.

This means that my company was out,

not just the purchase price,

but also the exam voucher itself

because we had already issued that to our buyer.

Because of this, we made the business decision

to stop selling exam vouchers

in certain countries around the world

because the rate of fraud was simply too high

and we wanted to avoid that risk.

The second thing we can do with risk is we can transfer it.

Now, risk transfer is a strategy that passes the risk

over to a third party,

and most commonly, this is done

by giving it to an insurance company.

Now, a good example of this is

if our organization was worried about the risk

of our server room being destroyed by a flood,

we could go out

and purchase insurance to transfer the risk

of losing all those assets over to a third party insurer.

Then if a flood did occur,

they're gonna write us a really large check

so we can replace all of our equipment

and pay for a data recovery team

to help restore our data and services.

The third thing we can do with risk is we can mitigate it.

Now, this is probably the most popular thing

that you're gonna see done with risk in the real world.

Risk mitigation is simply a strategy that seeks

to minimize the risk to an acceptable level

which an organization can then accept.

Now, for example, let's say,

if we identified there was a running server

that's identified to have five critical, two high,

four medium, and 17 low vulnerabilities.

Our risk management program might have a policy that states

that any server with a critical vulnerability

should be taken offline immediately.

But, if we can patch those five critical vulnerabilities,

they might be willing to accept the residual risk

from the high, medium and low vulnerabilities

because the overall risk was mitigated downwards

by adding those extra controls and patches

and bringing that overall risk level down

to an acceptable level.

Let's go back to my earlier example of the fraud

that occurred with our exam vouchers.

There were some countries where we experienced fraud

but it was at a lower level.

For example, our United States voucher program

actually experiences fraud on a regular basis,

but we've put in place certain mitigations

to block some of that fraud from occurring,

and we were able to get it down

to a low enough level of fraud

that we're able to continue offering the exam vouchers

without losing money.

Therefore, we made a business risk decision

to accept that residual risk level

after applying our risk mitigations for now.

The final thing we can do with risk is we can accept it.

Risk acceptance is the strategy that seeks

to accept the current level of risk

and the cost associated with it

if those risks were actually realized.

Generally this is the proper strategy

if the asset is very low-cost

or the impact in the organization would be very low.

For example, we may choose to transfer the risk

of a server being damaged by purchasing insurance

because those costs $10,000 or more to replace

but for a laptop, we might just accept that risk

because a laptop can be replaced for three to $500.

So how does an organization determine

which risk handling action they need to take,

or, when they've applied enough mitigations

to accept the residual risk?

Well, as in most things in life,

it's all about how much risk you're willing to accept.

Every organization is unique

and they have a different level

that they're willing to accept.

There's actually a term for this.

It's known as the organization's risk appetite.

Now, risk appetite is the amount of risk

that an organization is willing to accept

in pursuit of its objectives

before action is deemed necessary to reduce the risk level.

Often the term, risk appetite,

is also called risk attitude or risk tolerance.

For the exam, you may see these three terms

being used interchangeably,

and you'll also find this occurs in the real world as well.

Some organizations though, make a distinction

between risk appetite and risk tolerance.

When they talk of risk appetite

they refer to the overall generic level

of risk to the organization that they're willing to accept.

Conversely, when they talk

about risk tolerance in these organizations,

they're gonna be referring to a specific maximum risk

that organization is willing to take

in regards to a specific identified risk.

So if you're thinking about your organization,

remember they're gonna have an overall risk appetite

associated with the organization

that is set by your higher level decision makers

like the C-suite,

and then you're gonna find

that there are different levels of risk tolerance

within certain product lines, certain departments

or even certain servers within a department or division.

This risk appetite

and risk tolerance is going to affect the decisions you make

in regards to risk avoidance, risk transfer,

risk mitigation, and risk acceptance.

Now, as you decide which of these four to choose from

in your risk handling, remember,

there are always gonna be trade-offs that have to be made.

If you add more security,

you're adding more cost to the project.

Also, if you add more security

you're often reducing the usability of that system.

This is the never ending trade-off that occurs,

the war between usability and security.

For example, I worked for one organization

that required users to access their work email

only from a dedicated smartphone

that the organization issued them,

but that was gonna be a huge expense

so not everybody could access their email

because not everybody got a smartphone.

Instead, they chose five to 10% of the people

who were given a smartphone,

and those people could access their email

using that dedicated device.

Now, this was a security decision,

but its consequences was that the service became less usable

because 90 to 95% of the employees

couldn't access their email after working hours.

So who do you think had the smartphones?

Well, mostly it was the managers and the bosses.

So the bosses would be frantically sending out emails

at 8:00 PM at night when something went wrong,

and then they were surprised

when the workers didn't respond to them

until 8:00 AM the next day.

They would say things like,

but I sent you this email and I marked it as urgent.

Why didn't you respond?

Well, because we made that system so secure,

it made it so the only way people could access their email

was by driving into work and checking it from their desktop,

and they weren't gonna be doing that

at eight o'clock at night

if they didn't know there was a problem.

This is the idea of usability versus security.

You always have to keep this in mind

when you're making your security recommendations

at the end of a penetration test,

because just because something is more secure,

doesn't mean it's the right answer for that organization.