up

2020-01-27 - Risk

There’s an assignment in MyCourses and it’s scary

Controls and Risk

Controls exist to reduce or eliminate risk

Risk = Probability * dollar Impact

A Risk Management Team develops policies that will address risk.

Addressing risk:

• Reduce it
• Eliminate it
• Transfer it
• Accept it

Some companies just really heckin’ love accepting risk.

At this point I got a horrific nosebleed so the rest of these notes aren’t as awesome

insurance is a method for reducing risk. in ny you can self-insure your car

• mitigate
  • use controls. make the risk less
• avoid
  • don’t use the risky thing.
• transfer
  • insurance takes the risk
• accept
  • if it happens, we’ll eat it
  • cya

things

• security perimeter
  • imaginary
• attack surface
  • points of attack
  • comprehensive

attack graph shows how an attack can happen

• asset
• ta
• stride
• controls
• attacks
• exploits

non exhaustive list