Technical Risk Notes (Advanced FAQ)

It measures the propensity of an asset to cope with unknown risks.

It allows for assets to be ranked and prioritized according to their intrinsic abilities and surrounding controls so that companies and individuals can properly allocate resources to the most vulnerable, most problematic or least resistant assets, so those assets did not experience performance issues or become subverted or compromised when faced with a novel attack or other unknown risk.

Every company in the world with a risk management program. Risk Consultants. Banks and Governments. Any company in the world that considers their assets to be technology, processes, and people and need a method to allocate resources to those assets and make technical and financial decisions regarding those assets.

• The notion of an asset's exposure is not a new concept in risk or security.

• The notion of an asset's propensity to the unknown, however, allows an organization to determine which of their assets are more or less vulnerable as the organization and its processes (powered by the asset) evolve over time.

• Certain processes are inherently more sensitive than others i.e. some processes do better in the face of adversity and during periods of high stress and attack.

• In an organization where systems have been ranked according to their respective susceptibility (to unknown or novel attacks), decision-makers can dedicate resources to the exposures (and associated controls) that simply do not fare well during periods of high stress or attack.

• Certain processes demand greater attention and these should be focused in order to reduce an organization’s overall susceptibility to unknown threat vectors and the attack landscape.

Yes, you certainly can leverage your already existing risk methods, IT control frameworks, compliance artifacts — and your intelligence — to facilitate a transition toward the simplicity and power of an asset-based risk management program.

• Focus on the Impact. Focus on the Asset.

– Remember, you can’t predict, because it is not reliable at best (and impossible at worst).

• How to focus on Impact…

– Collect and Rank all of your Assets… by Process, Technology or Personnel

– Use a Risk-Impact-Value metric to calculate the value of each Asset

• Examples:

– Gross Sales / Revenue generated by Asset

– Net Profit generated by Asset

– # of Customers the Asset supports

– # of Employees the Asset involves

– Amount of Data Stored / Processed by the Asset

– Types and amounts of Important / Sensitive Data

• Risk is the possibility that an event will have a negative Impact on your Asset.

• Risk = a Threat versus an Asset’s Exposure and Vulnerability w/ Impact

– Impact: A negative effect

– Threat: Actor + Attack + Vector + Exploit

– Exposure: An asset’s actual physical or technical exposure to the world

– Vulnerability: An exposure’s weakness, defect, flaw, bug, misconfiguration

• Risk always exists. Risk is unknown. Even for previously known events, risk for those future events is STILL and will always be unknown.

• Asset: People, Process, Technology (PPT) or Technology, Process, Teams (TPT), the combination of those 3 components.

• Event: Something that happens, there is an input and an output. The input is some stress, noise, or threat. The output is called an Impact.

• Impact is the Key to Risk Success. Impact is what matters because risk can never be calculated directly. Never. Why?

• Information Technology and Cyber Security is an ecosystem that includes human agents. We, the human agents, have free will and exhibit irrational, unreliable, and unpredictable behaviors, and make mistakes.

• Dependency on humans is what makes reliable social science management and control a problem nearly impossible to solve. Physical sciences and mathematics are built from precise definitions with rigid and immutable controls. Conversely, social science domains with a human being operating or designing or programming, the realm of possible foreseeable events are not contained by a rigid, immutable control framework. The invisible hand, the event generator, is not clear…

• This equates to meaning that all events that spur up (i.e. zero-day attacks) are surprises, and that they are unpredictable, and that any risk calculation based on a probability of an event taking place, even in the context of a Threat and Attack Landscape model, subjects the decision-maker to ruin as the risk-taker faces an inherent ruin problem because these surprise-events can cripple and ruin you.

• Cyber Security Zero-day Attacks and Events can be modeled like the weather and natural disasters and be classified into two categories:

– Storms

– Earthquakes

• Storms:

– Rain – fairly predictable it will happen, but for HOW LONG (in minutes ?)

– Thunder / Lightning – can you predict it?

– Hail – sometimes, can you predict it will even happen?

– Wind – which direction? Which path does a Tornado take?

• Earthquakes:

– Knowable

– Unpredictable

– Non-linear Impact (i.e. the Richter Scale)

See Video Tutorials – URL upcoming

See Articles, FAQ and further Q&A ---> https://help.xerorisk.ai/

Ask me - Fin, our Customer Support bot agent