When we were younger,
my brother and I would go out and play a friendly
game of baseball in our backyard,
pretending to be some of the sports heroes of our day. And
my brother, being 3 years older than me,
13, and me 10, would just overwhelm me with pitches time and time again.
But one time I got lucky, and I made connection to the ball, and the
ball made a line drive that my brother had to duck, and it got stuck
in one of the borders of our yard, which was a chain link fence. It
was covered over by ivy.
My brother walked cautiously over to the fence.
The reason why is because on the other side of the fence were these
Dobermans. The ball being lodged inside the fence,
my brother had to stick his hand through the fence to push the ball back
to himself and got back a hand that had been bitten.
Now, this whole story actually communicates all the words
that we said describes risk. First,
let's start off with the threat agent and the threat source.
Now, it's important for you to be empathetic to my brother and stay in my
brother's perspective in order to define the elements of risk.
From my brother's perspective,
what would you say was the threat agent and the threat source?
Think about it for a moment.
Well, the threat agent was actually the dog,
just as a hacker is a threat agent, right? But what would you
say was the source of the threat agent?
Well, the hacker has malware, just as the dog has teeth.
It's not the tail of the dog,
it's a very particular tool or set of tools that that dog has.
When you think about a safeguard or a control in the story,
what would you say that was?
What was the primary safeguard from my brother's
perspective? If you say the fence,
you're right on. What would you say was the primary vulnerability in the story?
If you say the primary vulnerability is the fence, you have the right picture.
Wait a second. Is it true that a safeguard or a control
could actually be a vulnerability?
Think about what happened with the VPN under the pandemic of 2020.
Organization saw the VPN as a major security,
but because it was attacked so often and so successfully,
they started thinking of it also as a vulnerability.
The cybersecurity insider report sponsored by Zscaler in 2021
noted that 93% of organizations use a VPN service,
even though 94% of them are aware that it's a target for cyber
criminals. Seventy‑two percent of the organization are concerned that
the VPN may jeopardize its ability to keep their environment secure,
and therefore, they're moving to zero trust models that are not
dependent heavily on VPN capabilities.
What would you name as an asset in the story?
Well, one asset that was the center of our attention was the ball,
but the other important asset would be my brother's hand.
So, as we start considering these risk frameworks,
it's important to note that human safety should be the priority.