# Chapter 1: Risk Management

Source: Defensive Security Handbook: Best Practices for Securing Infrastructure by Lee Brotherston, Amanda Berlin

NIST Risk Management Functions:

- Identify
- Protect
- Detect
- Respond
- Recover

## Software Engineering Institute: OCTAVE Framework
Operationally Critical Threat, Asset, and Vulnerability Evaluation (OCTAVE)
https://resources.sei.cmu.edu/library/asset-view.cfm?assetID=309051

## Security Baseline
Information to gather:

* Policies and procedures 
* Endpoints desktops and servers, including implementation date and software version 
* Licensing and software renewal, as well as SSL certificates 
* Internet footprint: domains, mail servers, dmz devices 
* Networking devices: routers, switches, APs, IDS/IPS, and Network Traffic 
* Logging and monitoring 
* Ingress/egress points: ISP contacts, account numbers, and IP addresses
* External vendors, with or without remote access, and primary contacts

## Assessing threats and risks
Risk management is often split into four steps: 
- identify
- assess
- mitigate
- monitor

### Identify
- Focus on industry trends and industry specific risks:
Information Sharing and Analysis Centers (ISACs) / National Council of ISACs https://www.nationalisacs.org
- Overall trends: OWASP top 10 and CIS 20 Critical Security Controls

### Mitigation options
- Avoid risk, e.g.: stop storing Social Security numbers if they are unnecessary for the process
- Remediate risk, e.g.: turning off open ports, implementing stricter firewall rules, and patching endpoints
- Transfer risk, e.g.: outsourcing credit card processing to a third-party
- Accepting risk (last resort!)

## How Attackers Work
Intrusion Kill Chain / Cyber Kill Chain:

* Reconnaissance: research, identification, and selection of targets, e.g. crawling internet websites for email addresses, social relationships, or information on specific technologies. 
* Weaponization: coupling a remote access trojan with an exploit into a deliverable payload, such as Adobe Portable Document Format (PDF) or Microsoft Office documents.  
* Delivery: transmission of the weapon to the targeted environment, mostly by email attachments, websites, and USB removable media. 
* Exploitation: triggering intruders’ code. Most often, exploitation targets an application or operating system vulnerability, but it could also more simply exploit the users themselves or leverage an operating system feature that auto-executes code. 
* Installation: installation of the trojan or backdoor on the victim system.
* Command and Control (C2): establish an outbound beacon to an internet controller server; intruders now have “hands on the keyboard” access inside the target environment. 
* Actions on Objectives: intruders take actions to achieve their original objectives, e.g. data exfiltration, violations of data integrity or availability, use as a hopping point for further infiltration

Use cases to create and implement security-controls, see Table 1-1. Ransomware use case, also includes links to resources. 

Hold fire drills: https://www.fema.gov/media-library/assets/documents/26845



 