drupal hosting, avalanches safety and risk lessons
TRANSCRIPT
![Page 1: Drupal hosting, Avalanches Safety and Risk Lessons](https://reader035.vdocument.in/reader035/viewer/2022070605/5a6ed4287f8b9ad9638b5145/html5/thumbnails/1.jpg)
Drupal Hosting
Risk ManagementAvalanches
![Page 2: Drupal hosting, Avalanches Safety and Risk Lessons](https://reader035.vdocument.in/reader035/viewer/2022070605/5a6ed4287f8b9ad9638b5145/html5/thumbnails/2.jpg)
![Page 3: Drupal hosting, Avalanches Safety and Risk Lessons](https://reader035.vdocument.in/reader035/viewer/2022070605/5a6ed4287f8b9ad9638b5145/html5/thumbnails/3.jpg)
![Page 4: Drupal hosting, Avalanches Safety and Risk Lessons](https://reader035.vdocument.in/reader035/viewer/2022070605/5a6ed4287f8b9ad9638b5145/html5/thumbnails/4.jpg)
Daniel KanchevSiteGround.com
@dvkanchev
![Page 5: Drupal hosting, Avalanches Safety and Risk Lessons](https://reader035.vdocument.in/reader035/viewer/2022070605/5a6ed4287f8b9ad9638b5145/html5/thumbnails/5.jpg)
Risk Management Getting Started
![Page 6: Drupal hosting, Avalanches Safety and Risk Lessons](https://reader035.vdocument.in/reader035/viewer/2022070605/5a6ed4287f8b9ad9638b5145/html5/thumbnails/6.jpg)
Basic Terminology
![Page 7: Drupal hosting, Avalanches Safety and Risk Lessons](https://reader035.vdocument.in/reader035/viewer/2022070605/5a6ed4287f8b9ad9638b5145/html5/thumbnails/7.jpg)
![Page 8: Drupal hosting, Avalanches Safety and Risk Lessons](https://reader035.vdocument.in/reader035/viewer/2022070605/5a6ed4287f8b9ad9638b5145/html5/thumbnails/8.jpg)
Risk?
![Page 9: Drupal hosting, Avalanches Safety and Risk Lessons](https://reader035.vdocument.in/reader035/viewer/2022070605/5a6ed4287f8b9ad9638b5145/html5/thumbnails/9.jpg)
Risk = Threat + Vulnerability
![Page 10: Drupal hosting, Avalanches Safety and Risk Lessons](https://reader035.vdocument.in/reader035/viewer/2022070605/5a6ed4287f8b9ad9638b5145/html5/thumbnails/10.jpg)
Storytime
![Page 11: Drupal hosting, Avalanches Safety and Risk Lessons](https://reader035.vdocument.in/reader035/viewer/2022070605/5a6ed4287f8b9ad9638b5145/html5/thumbnails/11.jpg)
What Is The Single Most Important Thing Related to
Risk Management?
![Page 12: Drupal hosting, Avalanches Safety and Risk Lessons](https://reader035.vdocument.in/reader035/viewer/2022070605/5a6ed4287f8b9ad9638b5145/html5/thumbnails/12.jpg)
![Page 13: Drupal hosting, Avalanches Safety and Risk Lessons](https://reader035.vdocument.in/reader035/viewer/2022070605/5a6ed4287f8b9ad9638b5145/html5/thumbnails/13.jpg)
COMPANYMANAGEMENT
VISION
![Page 14: Drupal hosting, Avalanches Safety and Risk Lessons](https://reader035.vdocument.in/reader035/viewer/2022070605/5a6ed4287f8b9ad9638b5145/html5/thumbnails/14.jpg)
![Page 15: Drupal hosting, Avalanches Safety and Risk Lessons](https://reader035.vdocument.in/reader035/viewer/2022070605/5a6ed4287f8b9ad9638b5145/html5/thumbnails/15.jpg)
S3 Losses• S&P 500 - $150 Million
• U.S. financial companies - $160 million
![Page 16: Drupal hosting, Avalanches Safety and Risk Lessons](https://reader035.vdocument.in/reader035/viewer/2022070605/5a6ed4287f8b9ad9638b5145/html5/thumbnails/16.jpg)
Risk Categorisation
![Page 17: Drupal hosting, Avalanches Safety and Risk Lessons](https://reader035.vdocument.in/reader035/viewer/2022070605/5a6ed4287f8b9ad9638b5145/html5/thumbnails/17.jpg)
Risk Categorisation• Internal Risks • External Risks
![Page 18: Drupal hosting, Avalanches Safety and Risk Lessons](https://reader035.vdocument.in/reader035/viewer/2022070605/5a6ed4287f8b9ad9638b5145/html5/thumbnails/18.jpg)
Internal Company Conversations
![Page 19: Drupal hosting, Avalanches Safety and Risk Lessons](https://reader035.vdocument.in/reader035/viewer/2022070605/5a6ed4287f8b9ad9638b5145/html5/thumbnails/19.jpg)
Internal Company Conversations
• C-Level • Team Leaders • People from every department
![Page 20: Drupal hosting, Avalanches Safety and Risk Lessons](https://reader035.vdocument.in/reader035/viewer/2022070605/5a6ed4287f8b9ad9638b5145/html5/thumbnails/20.jpg)
Risk Management Getting Started
Recap
![Page 21: Drupal hosting, Avalanches Safety and Risk Lessons](https://reader035.vdocument.in/reader035/viewer/2022070605/5a6ed4287f8b9ad9638b5145/html5/thumbnails/21.jpg)
• Basic Terminology and Tools
• Management Vision Statement
• Internal Conversations
• Risk Categorisation
![Page 22: Drupal hosting, Avalanches Safety and Risk Lessons](https://reader035.vdocument.in/reader035/viewer/2022070605/5a6ed4287f8b9ad9638b5145/html5/thumbnails/22.jpg)
Risk Evaluation
![Page 23: Drupal hosting, Avalanches Safety and Risk Lessons](https://reader035.vdocument.in/reader035/viewer/2022070605/5a6ed4287f8b9ad9638b5145/html5/thumbnails/23.jpg)
Don’t Go
Experts Only
Basic
![Page 24: Drupal hosting, Avalanches Safety and Risk Lessons](https://reader035.vdocument.in/reader035/viewer/2022070605/5a6ed4287f8b9ad9638b5145/html5/thumbnails/24.jpg)
Too Scary to Go Out
Percentage of Fatalities: 1993-present
Most Fatalities
![Page 25: Drupal hosting, Avalanches Safety and Risk Lessons](https://reader035.vdocument.in/reader035/viewer/2022070605/5a6ed4287f8b9ad9638b5145/html5/thumbnails/25.jpg)
Obvious Risks
Low Impact Risks
Underestimated Risks
![Page 26: Drupal hosting, Avalanches Safety and Risk Lessons](https://reader035.vdocument.in/reader035/viewer/2022070605/5a6ed4287f8b9ad9638b5145/html5/thumbnails/26.jpg)
Avalanche Factors
![Page 27: Drupal hosting, Avalanches Safety and Risk Lessons](https://reader035.vdocument.in/reader035/viewer/2022070605/5a6ed4287f8b9ad9638b5145/html5/thumbnails/27.jpg)
IT Risk Management Factors• Importance of assets • Impact • Risk mitigation costs • Human factor • History of attacks
![Page 28: Drupal hosting, Avalanches Safety and Risk Lessons](https://reader035.vdocument.in/reader035/viewer/2022070605/5a6ed4287f8b9ad9638b5145/html5/thumbnails/28.jpg)
Risk Assessment Procedure
![Page 29: Drupal hosting, Avalanches Safety and Risk Lessons](https://reader035.vdocument.in/reader035/viewer/2022070605/5a6ed4287f8b9ad9638b5145/html5/thumbnails/29.jpg)
STEP 1: Assets Valuation
1. Quantitative Analysis
2. Qualitative Analysis
![Page 30: Drupal hosting, Avalanches Safety and Risk Lessons](https://reader035.vdocument.in/reader035/viewer/2022070605/5a6ed4287f8b9ad9638b5145/html5/thumbnails/30.jpg)
STEP 2: Impact AnalysisTiming/Duration Operations Impact Financial Impact
Christmas < 15 minutes
Checkout Down (Lost Sales) $10000 per hour
>2 hoursCRM Down
(Increased Expenses - Overtime Labor)
$2000 per hour
< 15 minutesWebsite Hacked
(Customer Data Exposed - Regulatory Fines)
$500000 fine
![Page 31: Drupal hosting, Avalanches Safety and Risk Lessons](https://reader035.vdocument.in/reader035/viewer/2022070605/5a6ed4287f8b9ad9638b5145/html5/thumbnails/31.jpg)
STEP 3: Likelihood DeterminationAvalanches IT Risk
• Weather Forecast • Skills of The Group • Past Events
• Threat-Source Motivation
• Threat Capacity • Nature of Vulnerability • Current Controls
![Page 32: Drupal hosting, Avalanches Safety and Risk Lessons](https://reader035.vdocument.in/reader035/viewer/2022070605/5a6ed4287f8b9ad9638b5145/html5/thumbnails/32.jpg)
![Page 33: Drupal hosting, Avalanches Safety and Risk Lessons](https://reader035.vdocument.in/reader035/viewer/2022070605/5a6ed4287f8b9ad9638b5145/html5/thumbnails/33.jpg)
Example Time• Latest Drupal 8 website • Custom Module + third-party library • Library got vulnerable • Module still uses an old library version
![Page 34: Drupal hosting, Avalanches Safety and Risk Lessons](https://reader035.vdocument.in/reader035/viewer/2022070605/5a6ed4287f8b9ad9638b5145/html5/thumbnails/34.jpg)
System Design
Vulnerable? Exploitable?Yes Yes
NoNo
Threat Source
Risk Exist
Attacker’s Cost < Gain
Loss Anticipated >
Threshold
Yes
No No
Yes Unacceptable Risk
![Page 35: Drupal hosting, Avalanches Safety and Risk Lessons](https://reader035.vdocument.in/reader035/viewer/2022070605/5a6ed4287f8b9ad9638b5145/html5/thumbnails/35.jpg)
Risk EvaluationRecap
![Page 36: Drupal hosting, Avalanches Safety and Risk Lessons](https://reader035.vdocument.in/reader035/viewer/2022070605/5a6ed4287f8b9ad9638b5145/html5/thumbnails/36.jpg)
• Know the Risk Levels
• Don’t Underestimate Risks
• Consider All Factors
• Determine Likelihood and Impact
![Page 37: Drupal hosting, Avalanches Safety and Risk Lessons](https://reader035.vdocument.in/reader035/viewer/2022070605/5a6ed4287f8b9ad9638b5145/html5/thumbnails/37.jpg)
Risk Avoidance Incidents Handling
![Page 38: Drupal hosting, Avalanches Safety and Risk Lessons](https://reader035.vdocument.in/reader035/viewer/2022070605/5a6ed4287f8b9ad9638b5145/html5/thumbnails/38.jpg)
Storytime
![Page 39: Drupal hosting, Avalanches Safety and Risk Lessons](https://reader035.vdocument.in/reader035/viewer/2022070605/5a6ed4287f8b9ad9638b5145/html5/thumbnails/39.jpg)
Risk Avoidance• Get the Basics • Get the Gear • Get the Training • Record Training Sessions • Use Recordings When Hiring People
![Page 40: Drupal hosting, Avalanches Safety and Risk Lessons](https://reader035.vdocument.in/reader035/viewer/2022070605/5a6ed4287f8b9ad9638b5145/html5/thumbnails/40.jpg)
Incidents Handling• Organise Workshops • Simulate Risks • Write Incidents Postmortems • Analyse Your Actions
![Page 41: Drupal hosting, Avalanches Safety and Risk Lessons](https://reader035.vdocument.in/reader035/viewer/2022070605/5a6ed4287f8b9ad9638b5145/html5/thumbnails/41.jpg)
![Page 42: Drupal hosting, Avalanches Safety and Risk Lessons](https://reader035.vdocument.in/reader035/viewer/2022070605/5a6ed4287f8b9ad9638b5145/html5/thumbnails/42.jpg)
• Form Two Teams - Offense vs Defense • Setup and use a QA/Test Environment • Offense Team Tries to Break Things • Defense Team Tries to Keep Things Up
War Room Tests
![Page 43: Drupal hosting, Avalanches Safety and Risk Lessons](https://reader035.vdocument.in/reader035/viewer/2022070605/5a6ed4287f8b9ad9638b5145/html5/thumbnails/43.jpg)
Risk Avoidance Incidents HandlingRecap
![Page 44: Drupal hosting, Avalanches Safety and Risk Lessons](https://reader035.vdocument.in/reader035/viewer/2022070605/5a6ed4287f8b9ad9638b5145/html5/thumbnails/44.jpg)
• Keep Everyone Informed • Perform Regular Trainings • Simulate Incidents • Write Incident Reports • Design For Failure
![Page 45: Drupal hosting, Avalanches Safety and Risk Lessons](https://reader035.vdocument.in/reader035/viewer/2022070605/5a6ed4287f8b9ad9638b5145/html5/thumbnails/45.jpg)
QUESTIONS ?