To talk about threat modeling and risk assessments now you should now have an understanding of your
abilities threats adversaries consequences and the resulting risk as well as how security is the process.
Actions and technologies that protect your assets privacy and anonymity.
We will now dig a little deeper into how to apply some of what we have learned.
First very important point.
You cannot ever have 100 percent security just like you can never have zero risk.
Therefore you can never completely protect your assets or maintain perfect privacy or have total anonymity.
If you've ever seen someone advertising a 100 percent security run a mile they have no clue about what
they're talking about unless you start engaging in an activity.
There will always be risk engaging in life has a risk going on the Internet has a risk.
We take these risks for the great opportunities and benefits that the Internet brings in order to exploit
the opportunity of using the Internet.
We have to accept a level of risk and you need to personally decide what is your tolerance for risk
based on your circumstances.
The lower tolerance for risk you have i.e. if the consequences of loss of security privacy or anonymity
is high then the more security controls you need the more advanced and often restrictive to use ability
security controls you will want the higher tolerance for risk you have i.e. the consequences might be
low.
The less security controls you will need.
So security is a balance.
It's a balance between usability and security between risk and opportunity and security often gets in
the way of ease of use which is why we must choose security controls that are fit for purpose and are
in line with our appetite for risk.
This course in the section on Know yourself and know your enemy will provide you with background information
on the threats and vulnerabilities that you might face on the Internet.
So you can make an informed choice on your needs for security privacy and anonymity and tolerance for
risk.
So wait until we go through those sections and then you will start to understand more the threat and
adversaries are out there and things that you may never have known about before.
Another very important point now you should take a risk based approach to your security.
We know we can't have 100 percent security.
So you need to take a risk based approach to applying the right level of security to mitigate the risk
without it being overburdened.
And to the point where the system is unuseable the only you can choose how big and burdensome your security
needs to be to protect your assets in order to take a risk based approach to security.
You should do basic a threat modeling and risk assessments when selecting your security controls.
And I walk you through an example of doing that now.
So risk equals vulnerabilities times threats times consequences.
So let's go through an assessment process now.
First we start with our assets.
You should now have a list or a rough list or idea of your assets based on the early videos you should
have a roof concept of the things you care about and want to protect vulnerabilities threats and adversaries.
You may have some understanding of what your threats are and your adversaries are which might be one
of the reasons why you choose to do the course or you may have no clear idea at all or be somewhere
in the middle.
In the section on Know your enemy we cover many of the vulnerabilities threats and adversaries.
When you go to that section determine which apply to you in order to determine your risk determine the
consequences of assets being compromised of threats being realized when it comes to your assets.
Consider if they are lost or stolen destroyed or encrypted so you can use them placed on the Internet
put in the hands of your adversaries criminals hackers government law enforcement agencies.
How could it impact your reputation your privacy and enormity.
What would be the impact of loss of privacy and anonymity.
What is your adversary likely to do.
Concentrate on the consequences if the threats and adversaries are less tangible to discover.
And that's a key point there.
Concentrate on consequences in order to determine the risk and the security controls you need to use.
If you're under standing in concept of the threats and adversaries are less tangible which is actually
often the case.
You consider the consequences the impact more.
Once you have an understanding of your assets their threats your abilities adversaries the security
controls are available to you.
You may not know what all the security controls are available to you or even how to configure them which
is what course is and you understand the consequences of threats being realized.
You will be able to determine a general level of risk that you feel you are at.
You might have identified particular risky behaviors that you perform threats adversaries vulnerabilities
that need the strongest security controls and most attention.
Let me give you an example of something you may have concluded.
Once you've gone through enough of the Course to be able to start doing threat modeling and risk assessments
maybe you're concerned about the threat of your laptop being stolen.
The adversary would be a thief.
The Vulnerability is the data on the laptop being in clear text and the consequences are reputational
damage and maybe identity theft based on your tolerance for risk.
You would select security controls that mitigate the risk and you should apply security controls to
the greatest risks first the whole course is a series of lessons on security controls how to apply them
why to apply them their strengths and weaknesses and so on as you go through the course select implement
assess monitor those security controls.
We go through when it comes to select select security controls at best mitigate the risks for example
of the stolen laptop that we were just talking about.
You could select whole disk encryption using locks and encrypted boot sector and pre-boot authentication
as some of your security controls that mitigate that threat then implement those controls.
You install looks hold this encryption and configure it then.
Ss ss the controls you have selected for their effectiveness check that the whole disk encryption is
working and the data is actually encrypted.
Then monitor monitor the effectiveness of the security controls check for security updates for example
and vulnerabilities in locks and so on.
If a weakness is discovered you go back to the select stage again.
So that's a threat modeling and risk assessment.
Once you've gone through a percentage of this cause you should start to feel more confident in assessing
the threats and adversaries Understanding where your vulnerabilities might be and then start to understand
where you apply the security controls to protect the things you care about privacy or anonymity or your
files or e-mail.
So I hope that helps in making sure you select the correct security controls gives you the maximum benefit
to protect your assets.