Week 12 CYBR 650 Blog

End of coursework...beginning of a new path.

I started this Cybersecurity program many years ago. Work and other life obligations have prolonged it more than I would have liked, nevertheless, this is the end. It is also coinciding with the end of my military career next spring, and along with that, the choice to decide what work I actually want to do going forward. There are so many niches in Cybersecurity that it is hard to narrow down what to focus on. This program, much like the CISSP I got before starting, is an inch deep and a mile wide. I leave feeling like I know a great deal about nearly all of the critical concepts, yet still understand that each of these topics take years of education and real-world application to even begin to consider yourself an expert. I understand a lot, yet feel like I know very little. 

Current Trends in Cybersecurity Conclusion

The CYBR 650 course was a great introduction to the topics of assessing the security of a system. In the course we learned how to define our own process for threat modeling, which detailed how to go from point A, a completely unknown system and run it through a comprehensive security assessment, to get to point Z, resolving all of the identified risks to a system.

The key milestones along the way included conducting a system assessment, or getting to know every facet of the system. Conducting a weakness and vulnerability assessment, and identifying threats to the system. This all gets assessed and we created an action plan based on the information, which recommended courses of action to resolve the identified threats.

This is an excellent phased approach to comprehensively assess and hopefully secure systems of varying complexity. Thankfully the target system, Harry and Mae’s, was a well-known quantity with several glaring issues. Accomplishing a threat model on a more complex system would be a whole different ballgame, as the individual components mentioned above are much harder to assess.

One issue I struggled with during this course, and really for all scenarios, is understanding threats on a level great enough to confidently assess likelihood. To assess the likelihood, you definitely need to consider how easy it is to exploit any of the identified vulnerabilities, like we did in class, but there are also more complex assessments required. You need to understand other qualities such as intent, capability, and the threat’s risk. These are much harder to capture, and sometimes they can be largely unknown. This almost sounds like suggesting that we should perform not just our own risk assessment, but one from the perspective of our enemy. Is their perceived reward worth the risk? Are they even at risk of capture or failure? Do they have the capability to exploit a vulnerability? How do we even know that?

These are all questions that ran through my head while accomplishing this. I am starting to conduct something similar in my work, and the threat assessment consistently appears to be the most difficult and most argued about topic in threat modeling. The concepts needed to accomplish this are one thing that I will continue to educate myself on. Each of the variables in risk have an equal say on the overall risk exposure, however the most contentious of these, which is the threat assessment in my opinion, is the one that is often just an educated guess.