Add files using upload-large-folder tool

.gitattributes

@@ -133,3 +133,36 @@ saved_model/**/* filter=lfs diff=lfs merge=lfs -text
 08[[:space:]]-[[:space:]]Social[[:space:]]Engineering/003[[:space:]]Vishing[[:space:]]OB[[:space:]]2.2.mp4 filter=lfs diff=lfs merge=lfs -text
 08[[:space:]]-[[:space:]]Social[[:space:]]Engineering/002[[:space:]]Phishing[[:space:]]OB[[:space:]]2.2.mp4 filter=lfs diff=lfs merge=lfs -text
 08[[:space:]]-[[:space:]]Social[[:space:]]Engineering/006[[:space:]]Misinformation[[:space:]]and[[:space:]]Disinformation[[:space:]]OB[[:space:]]2.2.mp4 filter=lfs diff=lfs merge=lfs -text
+08[[:space:]]-[[:space:]]Social[[:space:]]Engineering/005[[:space:]]Spear[[:space:]]Phishing[[:space:]]OB[[:space:]]2.2.mp4 filter=lfs diff=lfs merge=lfs -text
+08[[:space:]]-[[:space:]]Social[[:space:]]Engineering/007[[:space:]]Impersonation[[:space:]]OB[[:space:]]2.2.mp4 filter=lfs diff=lfs merge=lfs -text
+08[[:space:]]-[[:space:]]Social[[:space:]]Engineering/008[[:space:]]Business[[:space:]]Email[[:space:]]Compromise[[:space:]]OB[[:space:]]2.2.mp4 filter=lfs diff=lfs merge=lfs -text
+08[[:space:]]-[[:space:]]Social[[:space:]]Engineering/010[[:space:]]Watering[[:space:]]Hole[[:space:]]OB[[:space:]]2.2.mp4 filter=lfs diff=lfs merge=lfs -text
+08[[:space:]]-[[:space:]]Social[[:space:]]Engineering/009[[:space:]]Pretexting[[:space:]]OB[[:space:]]2.2.mp4 filter=lfs diff=lfs merge=lfs -text
+08[[:space:]]-[[:space:]]Social[[:space:]]Engineering/011[[:space:]]Brand[[:space:]]Impersonation[[:space:]]OB[[:space:]]2.2.mp4 filter=lfs diff=lfs merge=lfs -text
+08[[:space:]]-[[:space:]]Social[[:space:]]Engineering/012[[:space:]]Typosquatting[[:space:]]OB[[:space:]]2.2.mp4 filter=lfs diff=lfs merge=lfs -text
+08[[:space:]]-[[:space:]]Social[[:space:]]Engineering/013[[:space:]]Training[[:space:]]against[[:space:]]Phishing[[:space:]]OB[[:space:]]5.6.mp4 filter=lfs diff=lfs merge=lfs -text
+08[[:space:]]-[[:space:]]Social[[:space:]]Engineering/014[[:space:]]Security[[:space:]]Awareness[[:space:]]Program[[:space:]]OB[[:space:]]5.6.mp4 filter=lfs diff=lfs merge=lfs -text
+09[[:space:]]-[[:space:]]Securing[[:space:]]IT[[:space:]]Assets/001[[:space:]]Segmentation[[:space:]]OB[[:space:]]2.5.mp4 filter=lfs diff=lfs merge=lfs -text
+09[[:space:]]-[[:space:]]Securing[[:space:]]IT[[:space:]]Assets/002[[:space:]]Isolation[[:space:]]OB[[:space:]]2.5.mp4 filter=lfs diff=lfs merge=lfs -text
+09[[:space:]]-[[:space:]]Securing[[:space:]]IT[[:space:]]Assets/003[[:space:]]Access[[:space:]]Control[[:space:]]OB[[:space:]]2.5.mp4 filter=lfs diff=lfs merge=lfs -text
+09[[:space:]]-[[:space:]]Securing[[:space:]]IT[[:space:]]Assets/005[[:space:]]Access[[:space:]]Control[[:space:]]List[[:space:]]OB[[:space:]]2.5.mp4 filter=lfs diff=lfs merge=lfs -text
+09[[:space:]]-[[:space:]]Securing[[:space:]]IT[[:space:]]Assets/004[[:space:]]Principles[[:space:]]of[[:space:]]Least[[:space:]]Privilege[[:space:]]OB[[:space:]]2.5.mp4 filter=lfs diff=lfs merge=lfs -text
+09[[:space:]]-[[:space:]]Securing[[:space:]]IT[[:space:]]Assets/007[[:space:]]Application[[:space:]]Allow[[:space:]]List[[:space:]]OB[[:space:]]2.5.mp4 filter=lfs diff=lfs merge=lfs -text
+09[[:space:]]-[[:space:]]Securing[[:space:]]IT[[:space:]]Assets/006[[:space:]]Filesystem[[:space:]]Permissions[[:space:]]OB[[:space:]]2.5.mp4 filter=lfs diff=lfs merge=lfs -text
+09[[:space:]]-[[:space:]]Securing[[:space:]]IT[[:space:]]Assets/009[[:space:]]Configuration[[:space:]]Enforcement[[:space:]]OB[[:space:]]2.5.mp4 filter=lfs diff=lfs merge=lfs -text
+09[[:space:]]-[[:space:]]Securing[[:space:]]IT[[:space:]]Assets/008[[:space:]]Patching[[:space:]]OB[[:space:]]2.5.mp4 filter=lfs diff=lfs merge=lfs -text
+09[[:space:]]-[[:space:]]Securing[[:space:]]IT[[:space:]]Assets/010[[:space:]]Decommissioning[[:space:]]OB[[:space:]]2.5.mp4 filter=lfs diff=lfs merge=lfs -text
+09[[:space:]]-[[:space:]]Securing[[:space:]]IT[[:space:]]Assets/011[[:space:]]Monitoring[[:space:]]OB[[:space:]]2.5.mp4 filter=lfs diff=lfs merge=lfs -text
+09[[:space:]]-[[:space:]]Securing[[:space:]]IT[[:space:]]Assets/012[[:space:]]Hardening[[:space:]]Techniques[[:space:]]OB[[:space:]]2.5.mp4 filter=lfs diff=lfs merge=lfs -text
+10[[:space:]]-[[:space:]]Security[[:space:]]Architecture/001[[:space:]]Cloud[[:space:]]OB[[:space:]]3.1.mp4 filter=lfs diff=lfs merge=lfs -text
+10[[:space:]]-[[:space:]]Security[[:space:]]Architecture/003[[:space:]]Serverless[[:space:]]Architecture[[:space:]]OB[[:space:]]3.1.mp4 filter=lfs diff=lfs merge=lfs -text
+10[[:space:]]-[[:space:]]Security[[:space:]]Architecture/002[[:space:]]Infrastructure[[:space:]]as[[:space:]]Code[[:space:]]OB[[:space:]]3.1.mp4 filter=lfs diff=lfs merge=lfs -text
+10[[:space:]]-[[:space:]]Security[[:space:]]Architecture/004[[:space:]]Microservices[[:space:]]OB[[:space:]]3.1.mp4 filter=lfs diff=lfs merge=lfs -text
+10[[:space:]]-[[:space:]]Security[[:space:]]Architecture/005[[:space:]]Air[[:space:]]Gapped[[:space:]]OB[[:space:]]3.1.mp4 filter=lfs diff=lfs merge=lfs -text
+10[[:space:]]-[[:space:]]Security[[:space:]]Architecture/007[[:space:]]On-Premises[[:space:]]OB[[:space:]]3.1.mp4 filter=lfs diff=lfs merge=lfs -text
+10[[:space:]]-[[:space:]]Security[[:space:]]Architecture/006[[:space:]]Software-Defined[[:space:]]Networking[[:space:]]OB[[:space:]]3.1.mp4 filter=lfs diff=lfs merge=lfs -text
+10[[:space:]]-[[:space:]]Security[[:space:]]Architecture/008[[:space:]]Centralized[[:space:]]vs.[[:space:]]Decentralized[[:space:]]OB[[:space:]]3.1.mp4 filter=lfs diff=lfs merge=lfs -text
+10[[:space:]]-[[:space:]]Security[[:space:]]Architecture/009[[:space:]]Virtualization[[:space:]]OB[[:space:]]3.1.mp4 filter=lfs diff=lfs merge=lfs -text
+10[[:space:]]-[[:space:]]Security[[:space:]]Architecture/010[[:space:]]Containerization[[:space:]]OB[[:space:]]3.1.mp4 filter=lfs diff=lfs merge=lfs -text
+10[[:space:]]-[[:space:]]Security[[:space:]]Architecture/011[[:space:]]High[[:space:]]Availability[[:space:]]OB[[:space:]]3.1.mp4 filter=lfs diff=lfs merge=lfs -text
+10[[:space:]]-[[:space:]]Security[[:space:]]Architecture/013[[:space:]]ICS[[:space:]]OB[[:space:]]3.1.mp4 filter=lfs diff=lfs merge=lfs -text

08 - Social Engineering/005 Spear Phishing OB 2.2.mp4

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:33817e9440664590d364c3a5ac0457d1cf3d4344e5d8cc06bfe9310c469ff374
+size 243728707

08 - Social Engineering/007 Impersonation OB 2.2.mp4

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:84500dfa8248e7c3a4520c043defab68eb4ba9fb0f53b426dedf291d087224ab
+size 146609459

08 - Social Engineering/008 Business Email Compromise OB 2.2.mp4

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:86ba65fdbf0c8c98c8ff6bf7198c06b7b1de50bffc997dd4807b93094894a639
+size 146064157

08 - Social Engineering/009 Pretexting OB 2.2.mp4

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:06d638ed3ad9abd537b9848a1a0a28b8c3d9ec3ada49703b4e22f4bc823e7eab
+size 208963164

08 - Social Engineering/010 Watering Hole OB 2.2.mp4

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:74a70cafc05e7560b7fc660c19784f49e64de7a38f4df7bc959a67eb334d07ee
+size 191350680

08 - Social Engineering/011 Brand Impersonation OB 2.2.mp4

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:fd07516b14d370c2fbd49d8d1cb75f02149b2359c549c644cb2e3c6a568cf1cc
+size 120682958

08 - Social Engineering/012 Typosquatting OB 2.2.mp4

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:b7e3c1ab4603f980f199544225b39aacf69b307452b72162828d0e81cae5e353
+size 226674750

08 - Social Engineering/013 Training against Phishing OB 5.6.mp4

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:174997c17366cbd07ceae687d00d495cfd0f5b81187086e9b01a8859e3ed3f7b
+size 213174958

08 - Social Engineering/014 Security Awareness Program OB 5.6.mp4

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:22641fc1822b5ba9c357ec85938ff4031ad8cfc2952f5852a0a031d277de0cfe
+size 223183545

09 - Securing IT Assets/001 Segmentation OB 2.5.mp4

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:0c4f0f6b27eb1c75c27b8d0cf7bd392a00150adec3217b880431c14906a8adc1
+size 229078501

09 - Securing IT Assets/002 Isolation OB 2.5.mp4

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:32dd560740f2a381ee6807c0ed3e8463e651f003f6ee16539f6bc847d92494df
+size 255600569

09 - Securing IT Assets/003 Access Control OB 2.5.mp4

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:a634e9b68f524e2eabc5361ca815d4032ea3098ef22c2a734b40cca6bead6c74
+size 130346468

09 - Securing IT Assets/004 Principles of Least Privilege OB 2.5.mp4

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:451cfb0122fcb168220044a2b8dd37ff06aefba2d4a156502c82b654fea2e6b7
+size 140483198

09 - Securing IT Assets/005 Access Control List OB 2.5.mp4

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:1f46f459cecf28e2209ae38d75ab9673c356e21034aa5a0b11e56af3ccb62748
+size 80763470

09 - Securing IT Assets/006 Filesystem Permissions OB 2.5.mp4

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:6dd5822f232a8da329ab4e45723fc5425a5df7d9e114a5c04a322dd959f0ab5e
+size 207582053

09 - Securing IT Assets/007 Application Allow List OB 2.5.mp4

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:ef792351b3328095cb67971f74195f7b0326bde581213dc6f68df24318ac8418
+size 77594987

09 - Securing IT Assets/008 Patching OB 2.5.mp4

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:ff10141ae450dd7e6237aebfc8658aedfb2ec596420bee9e5069d696ee59f5fe
+size 164696270

09 - Securing IT Assets/009 Configuration Enforcement OB 2.5.mp4

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:0efce9153d54b004f221be25bc49323bc299d2708ef090b3c75ae3586a2692d0
+size 101018118

09 - Securing IT Assets/010 Decommissioning OB 2.5.mp4

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:c1c63c118e4b9e3c876fcf1647d8ba6cb101f2721a3d09bd7f6512d84f28642d
+size 166973644

09 - Securing IT Assets/011 Monitoring OB 2.5.mp4

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:9feb3619ba2c6ee323898656074bd5dd441f7d72d1498b0ae89a10df24ad856b
+size 129115103

09 - Securing IT Assets/012 Hardening Techniques OB 2.5.mp4

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:c9e1777edb1557bcbfe8732868839e0326f403154a2950c2f022f6ba12bafe1d
+size 440558615

10 - Security Architecture/001 Cloud OB 3.1.mp4

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:d97d150bda22e1f679687878dcc9dbd8d5e575ca6e2b92e5c2f0c032b3728abb
+size 511591304

10 - Security Architecture/002 Infrastructure as Code OB 3.1.mp4

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:976a3b50ba018c8bb63c1f35b400aa4597909971dc359f0370bd1471e098419d
+size 153103708

10 - Security Architecture/003 Serverless Architecture OB 3.1.mp4

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:7f753ffd503baecf5d5073246ceeaf302dcf73709cb234a7f40cfed362ace493
+size 97395474

10 - Security Architecture/004 Microservices OB 3.1.mp4

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:eb69f2536bc8a9a6b9e54e4de52291302518639303028f4c3b69b3e179891df6
+size 135693215

10 - Security Architecture/005 Air Gapped OB 3.1.mp4

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:ab7b3f8ae4af31020d8dee0752882f7e2140201c0f6ea3d2b7001dc0d34f8e0b
+size 99208855

10 - Security Architecture/006 Software-Defined Networking OB 3.1.mp4

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:38ff5c09641718366c45565821aaf767dbae05488e80840b8c16befcfc129f5d
+size 219936591

10 - Security Architecture/007 On-Premises OB 3.1.mp4

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:b4e92596402ff78bdb273f7e3f3d752bc1e859ab7348c6ee0c4a98942328afd9
+size 53459965

10 - Security Architecture/008 Centralized vs. Decentralized OB 3.1.mp4

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:7b69fff1ae23a2ae3f0de9286cf3ffd92fa111b02a2b82084f8234a8a5a18658
+size 178712004

10 - Security Architecture/009 Virtualization OB 3.1.mp4

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:8bb61d45846d6513739bbeb3ace86ac2a86f1980a437e56e77ec08cd887c8993
+size 301783477

10 - Security Architecture/010 Containerization OB 3.1.mp4

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:894f74391eee91494c903790eeae243fea3068ce0840cb08bc3c69e71de019cc
+size 220510089

10 - Security Architecture/011 High Availability OB 3.1.mp4

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:5a93f0a1eb6b93a13f3b7bb16a8c12bb8c9372b74b956a5453ac0544cfa99ed7
+size 186692724

10 - Security Architecture/013 ICS OB 3.1.mp4

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:5305d91a5764667386e2f0cdc270b3bbc5d8a5609e1200f1de342c1180bd1b90
+size 204975036

20 - Security Governance and Privacy/006 Privacy OB 5.4_en.srt

@@ -0,0 +1,552 @@
+1
+00:00:00,000 --> 00:00:04,000
+The hottest topic in the world of cybersecurity right now is privacy.
+
+2
+00:00:04,000 --> 00:00:07,000
+Did you guess that privacy is a big thing nowadays?
+
+3
+00:00:08,000 --> 00:00:13,000
+Almost anytime you hear malware gets into an organization and steals the data, or hackers steals the
+
+4
+00:00:13,000 --> 00:00:18,000
+data, or disgruntled employee steals the data, it's always about the loss of private data.
+
+5
+00:00:19,000 --> 00:00:22,000
+So in this video, let's take a look at privacy.
+
+6
+00:00:22,000 --> 00:00:25,000
+Just the entire topic of privacy.
+
+7
+00:00:25,000 --> 00:00:28,000
+And there's a couple of terms that I want you guys to be familiar with.
+
+8
+00:00:28,000 --> 00:00:30,000
+So if you see on your exam you're familiar with it.
+
+9
+00:00:30,000 --> 00:00:37,000
+Privacy refers to the practices, policies, and legal requirements surrounding the protection of personal
+
+10
+00:00:37,000 --> 00:00:38,000
+and sensitive data.
+
+11
+00:00:38,000 --> 00:00:40,000
+Now, what data are we talking about?
+
+12
+00:00:40,000 --> 00:00:41,000
+What is it that we're secure?
+
+13
+00:00:41,000 --> 00:00:45,000
+Well, privacy information falls into two things.
+
+14
+00:00:45,000 --> 00:00:47,000
+What's known as PII information.
+
+15
+00:00:49,000 --> 00:00:55,000
+Are known as personal identifiable info and protected health, also known as personal health info.
+
+16
+00:00:55,000 --> 00:00:57,000
+So PII and Phi.
+
+17
+00:00:57,000 --> 00:00:59,000
+So what exactly is PII?
+
+18
+00:00:59,000 --> 00:01:05,000
+Well, it's information that when used alone or with other relevant data, can identify the individual.
+
+19
+00:01:06,000 --> 00:01:08,000
+And then there's Phi.
+
+20
+00:01:08,000 --> 00:01:15,000
+Now this is the demographic information, medical history, tests and laboratory results, mental health
+
+21
+00:01:15,000 --> 00:01:22,000
+conditions, insurance information or other information is generally collected to care for a person.
+
+22
+00:01:22,000 --> 00:01:25,000
+Let me give you a couple of examples of what PII and Phi.
+
+23
+00:01:25,000 --> 00:01:26,000
+So.
+
+24
+00:01:27,000 --> 00:01:34,000
+Your address, your, uh, your email address, physical address, email, your phone number, your
+
+25
+00:01:34,000 --> 00:01:35,000
+credit card information.
+
+26
+00:01:35,000 --> 00:01:41,000
+That's going to be PII, what medication you're taking, what illnesses you have, what what was your
+
+27
+00:01:41,000 --> 00:01:43,000
+recent blood tests and things like that.
+
+28
+00:01:43,000 --> 00:01:44,000
+That would be Fi.
+
+29
+00:01:44,000 --> 00:01:49,000
+These are both considered private information that falls under the terms of privacy, and they need
+
+30
+00:01:49,000 --> 00:01:50,000
+to be protected.
+
+31
+00:01:50,000 --> 00:01:54,000
+Privacy is a critical thing when it comes to the world of security.
+
+32
+00:01:54,000 --> 00:02:01,000
+Now, if there's one thing we know about privacy is that it's heavily regulated, not just locally.
+
+33
+00:02:02,000 --> 00:02:05,000
+But sometimes regionally, nationally and globally.
+
+34
+00:02:05,000 --> 00:02:11,000
+Laws like GDPR in Europe, CcpA, which is done in California, which is similar to GDPR.
+
+35
+00:02:11,000 --> 00:02:18,000
+Basically, these are privacy laws that is out there to secure people's private information PII and
+
+36
+00:02:19,000 --> 00:02:20,000
+Phi.
+
+37
+00:02:20,000 --> 00:02:25,000
+Now, the first thing we want to talk about is that you're going to have local or regional laws that
+
+38
+00:02:25,000 --> 00:02:27,000
+you have to follow.
+
+39
+00:02:27,000 --> 00:02:31,000
+These are going to address specific things in a smaller geographic community.
+
+40
+00:02:31,000 --> 00:02:34,000
+These laws can be very detailed or stricter.
+
+41
+00:02:34,000 --> 00:02:40,000
+For example, in a town they may have a certain way that private data should be stored.
+
+42
+00:02:40,000 --> 00:02:44,000
+Or if you want to do business in this town, you have to secure the private data.
+
+43
+00:02:44,000 --> 00:02:47,000
+This is where you have to store it in a certain pattern.
+
+44
+00:02:47,000 --> 00:02:53,000
+Now, you know that's local legal ramifications or local legal laws.
+
+45
+00:02:53,000 --> 00:02:58,000
+Then you have national laws that are broader in scope that the entire country has to follow.
+
+46
+00:02:59,000 --> 00:03:02,000
+This is how organizations across an entire country is going to have to follow.
+
+47
+00:03:02,000 --> 00:03:08,000
+Things like this is going to include like HIPAA compliance, which is every single clinic and hospital
+
+48
+00:03:08,000 --> 00:03:10,000
+within the United States have to follow.
+
+49
+00:03:12,000 --> 00:03:18,000
+Then you can have global laws that anybody wants to do business in this country.
+
+50
+00:03:18,000 --> 00:03:19,000
+They got to follow it.
+
+51
+00:03:19,000 --> 00:03:25,000
+Now this is especially organizations that falls into operating internationally.
+
+52
+00:03:25,000 --> 00:03:28,000
+You're dealing with data across national borders.
+
+53
+00:03:28,000 --> 00:03:34,000
+So for example with with GDPR which is a general data protection.
+
+54
+00:03:34,000 --> 00:03:43,000
+This particular regulation is done to protect the privacy data of the EU citizens, now EU citizens.
+
+55
+00:03:44,000 --> 00:03:49,000
+Doesn't matter what country they're in, their data needs to be protected by GDPR.
+
+56
+00:03:49,000 --> 00:03:53,000
+Doesn't matter what country your organization is in, you need to follow GDPR.
+
+57
+00:03:53,000 --> 00:04:01,000
+So if you work in a company that follows or works in multiple countries, that company needs to follow
+
+58
+00:04:01,000 --> 00:04:03,000
+all these laws across all these different countries.
+
+59
+00:04:03,000 --> 00:04:07,000
+And that, of course, is very complex to do.
+
+60
+00:04:07,000 --> 00:04:11,000
+Now, there are some terms when it comes to processing private data.
+
+61
+00:04:12,000 --> 00:04:13,000
+A couple of terms.
+
+62
+00:04:13,000 --> 00:04:14,000
+What's called the data subject.
+
+63
+00:04:15,000 --> 00:04:18,000
+Data controllers and data processor.
+
+64
+00:04:18,000 --> 00:04:19,000
+So let's go through this.
+
+65
+00:04:19,000 --> 00:04:24,000
+A data subject is an individual whose personal data is processed by an organization.
+
+66
+00:04:24,000 --> 00:04:28,000
+You have to protect the rights and privacy of the data subjects.
+
+67
+00:04:28,000 --> 00:04:36,000
+This includes ensuring consistent, uh, consistency for the data, uh, making sure you get consent
+
+68
+00:04:36,000 --> 00:04:41,000
+for the data and processing and allowing the data to be processed correctly.
+
+69
+00:04:41,000 --> 00:04:46,000
+Now, keep in mind the data subject is just a user to the website.
+
+70
+00:04:46,000 --> 00:04:51,000
+If you're going to Facebook right now, you're the data subject on a website.
+
+71
+00:04:51,000 --> 00:04:54,000
+You're going to have what's called a controller and a processor.
+
+72
+00:04:54,000 --> 00:05:00,000
+In privacy terms, a controller is an entity that determines the purpose and means of person processing.
+
+73
+00:05:00,000 --> 00:05:09,000
+Personal data A processor is an entity that the that processes the data on behalf of the controller.
+
+74
+00:05:09,000 --> 00:05:09,000
+Let me explain.
+
+75
+00:05:09,000 --> 00:05:11,000
+I'll give you guys a couple of examples of this.
+
+76
+00:05:11,000 --> 00:05:14,000
+So you have a data subject a controller and a processor.
+
+77
+00:05:14,000 --> 00:05:16,000
+Let's say you have a website.
+
+78
+00:05:17,000 --> 00:05:23,000
+And you own a website, you're going to determine what data we collect.
+
+79
+00:05:23,000 --> 00:05:29,000
+You're going to then determine how you're going to store that data, why you need to collect the data.
+
+80
+00:05:29,000 --> 00:05:30,000
+Then you have a website user.
+
+81
+00:05:30,000 --> 00:05:34,000
+So the website user is just coming to browse what you have on your website.
+
+82
+00:05:34,000 --> 00:05:36,000
+Then you have something like Google Analytics.
+
+83
+00:05:36,000 --> 00:05:38,000
+Now Google Analytics is just Google.
+
+84
+00:05:38,000 --> 00:05:43,000
+And all they're doing is they're processing all the data on your website to see how many visitors you
+
+85
+00:05:43,000 --> 00:05:45,000
+had and how long they stayed on your website.
+
+86
+00:05:46,000 --> 00:05:52,000
+So let's go through the three, the three terms the data subject, controller and processor.
+
+87
+00:05:52,000 --> 00:05:55,000
+So the data subject is just users.
+
+88
+00:05:55,000 --> 00:06:01,000
+The data controller is you, the data controller is who's going to determine, okay, why do we need
+
+89
+00:06:01,000 --> 00:06:02,000
+this data.
+
+90
+00:06:02,000 --> 00:06:04,000
+Why where are we going to store this data.
+
+91
+00:06:06,000 --> 00:06:07,000
+What are we going to do with this data.
+
+92
+00:06:08,000 --> 00:06:16,000
+Now who's getting the data are processing the data and coming out with specific outputs.
+
+93
+00:06:16,000 --> 00:06:17,000
+Google analytics.
+
+94
+00:06:17,000 --> 00:06:20,000
+So Google is going to be the processor.
+
+95
+00:06:20,000 --> 00:06:22,000
+You are the data controller.
+
+96
+00:06:22,000 --> 00:06:25,000
+And then the person using a website is the subject.
+
+97
+00:06:26,000 --> 00:06:30,000
+Another time you want to be, uh, familiar with is what's called ownership.
+
+98
+00:06:30,000 --> 00:06:33,000
+Data ownership refers to the rights and control of the data.
+
+99
+00:06:33,000 --> 00:06:38,000
+Like who owns the data, who's controlling the data, what they determine what you should do with the
+
+100
+00:06:38,000 --> 00:06:39,000
+data.
+
+101
+00:06:40,000 --> 00:06:46,000
+It relates to the ownership of personal data by data subjects and the organizations responsibility.
+
+102
+00:06:46,000 --> 00:06:47,000
+Now.
+
+103
+00:06:47,000 --> 00:06:52,000
+One thing an organization should always do is have data inventory.
+
+104
+00:06:52,000 --> 00:06:54,000
+What exactly is that?
+
+105
+00:06:54,000 --> 00:07:00,000
+Well, an organization, and I believe every company should do this, is to go and make an inventory
+
+106
+00:07:00,000 --> 00:07:03,000
+of all the different data that they have collected.
+
+107
+00:07:03,000 --> 00:07:08,000
+Sometimes organizations are very surprised to see what they have collected.
+
+108
+00:07:08,000 --> 00:07:10,000
+What exactly have they hold?
+
+109
+00:07:10,000 --> 00:07:11,000
+Where is it stored?
+
+110
+00:07:11,000 --> 00:07:14,000
+How long have they had it?
+
+111
+00:07:15,000 --> 00:07:17,000
+How is it being used?
+
+112
+00:07:17,000 --> 00:07:22,000
+So you want to make sure that you do this data inventory to see basically what data do you have.
+
+113
+00:07:22,000 --> 00:07:28,000
+And then the other thing is certain regulations will dictate how long you can hold certain data for.
+
+114
+00:07:28,000 --> 00:07:32,000
+So data retention policies must align with legal requirements.
+
+115
+00:07:32,000 --> 00:07:36,000
+For example, one law may specify that you need to hold the data for eight years.
+
+116
+00:07:36,000 --> 00:07:38,000
+Another law may say you need to hold it for 20 years.
+
+117
+00:07:38,000 --> 00:07:40,000
+So make sure you know the laws.
+
+118
+00:07:41,000 --> 00:07:44,000
+Here's a firm you're probably going to see on your exam.
+
+119
+00:07:44,000 --> 00:07:50,000
+It's called right to be forgotten and this is something that you're probably familiar with right now.
+
+120
+00:07:50,000 --> 00:07:56,000
+Do you guys know you can go and tell Facebook to delete your data and your profile and Google also.
+
+121
+00:07:57,000 --> 00:08:01,000
+Just Google the steps of how to do that, but that's a right to be forgotten.
+
+122
+00:08:01,000 --> 00:08:08,000
+We now have to give this right, and GDPR makes it pretty much mandatory that there is a right to be
+
+123
+00:08:08,000 --> 00:08:09,000
+forgotten.
+
+124
+00:08:09,000 --> 00:08:17,000
+Now, it's also known the right to erasure is a principle that allows individuals to request a deletion
+
+125
+00:08:17,000 --> 00:08:21,000
+of their personal data when there's no compelling reason for it to be continued processing.
+
+126
+00:08:22,000 --> 00:08:25,000
+For example, maybe you don't use Facebook anymore.
+
+127
+00:08:25,000 --> 00:08:28,000
+Maybe you never logged in in the last two years and you don't plan to.
+
+128
+00:08:28,000 --> 00:08:31,000
+So you can go to Facebook and you could say, well, you know what?
+
+129
+00:08:31,000 --> 00:08:33,000
+I don't want my data stored here anymore.
+
+130
+00:08:34,000 --> 00:08:37,000
+So that's known as a right to be forgotten.
+
+131
+00:08:37,000 --> 00:08:40,000
+And what they're going to do is they're going to delete your profile and all of your data that they
+
+132
+00:08:40,000 --> 00:08:43,000
+have on their systems that have they ever hacked or anything like that.
+
+133
+00:08:43,000 --> 00:08:45,000
+They can't get your data.
+
+134
+00:08:45,000 --> 00:08:45,000
+Okay.
+
+135
+00:08:45,000 --> 00:08:48,000
+Make sure you understand that privacy is a very serious subject.
+
+136
+00:08:48,000 --> 00:08:55,000
+And although most of the time what we do with privacy and how we manage privacy is going to be managed
+
+137
+00:08:55,000 --> 00:09:02,000
+by regulations or dictated by different regulations, keep in mind that even if it's not, it's something
+
+138
+00:09:02,000 --> 00:09:07,000
+that you have to follow all the time because it is super important to protect our customers information.
+

20 - Security Governance and Privacy/007 Quick Quiz.html

@@ -0,0 +1,479 @@
+<!DOCTYPE html>
+<html lang="en">
+    <head>
+        <meta charset="UTF-8" />
+        <meta http-equiv="X-UA-Compatible" content="IE=edge" />
+        <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+        <title>Quiz</title>
+        <style>
+            * {
+                font-family: system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Oxygen, Ubuntu, Cantarell,
+                    "Open Sans", "Helvetica Neue", sans-serif;
+                margin: 0;
+                padding: 0;
+                box-sizing: border-box;
+                font-size: 16px;
+            }
+
+            main {
+                padding-top: 48px;
+            }
+
+            :root {
+                --large-device-width: 850px;
+                --primary-color: #0f172a;
+                --secondary-color: #020617;
+                --primary-text-color: #c7d1dd;
+                --secondary-text-color: #061602;
+                --success-background: hsl(159, 82%, 24%);
+                --success-foreground: hsl(164, 86%, 16%);
+                --success: hsl(160, 84%, 39%);
+                --danger: #ef4444;
+                --warning: #f59e0b;
+                --info-background: hsl(218, 81%, 8%);
+                --info-foreground: hsl(217, 91%, 85%);
+                --border-color: #d1d7dc;
+                --check-box-size: 20px;
+                /* control the size */
+                --check-box-color: var(--info-foreground);
+                /* the active color */
+            }
+
+            body {
+                position: relative;
+                background-color: #020617;
+                color: var(--primary-text-color);
+            }
+
+            #score-stats-container {
+                position: fixed;
+                z-index: 10;
+                top: 0;
+                height: 40px;
+                width: 100%;
+                background-color: var(--info-background);
+
+                padding: 0px 16px;
+                color: var(--info-foreground);
+                font-weight: 600;
+                display: flex;
+                align-items: center;
+                justify-content: space-between;
+            }
+
+            #quiz-container {
+                border-radius: 8px;
+                display: flex;
+                gap: 16px;
+                flex-direction: column;
+            }
+
+            input[type="radio"] {
+                height: var(--check-box-size);
+                aspect-ratio: 1;
+                border: calc(var(--check-box-size) / 8) solid #939393;
+                padding: calc(var(--check-box-size) / 8);
+                background: radial-gradient(farthest-side, var(--check-box-color) 94%, #0000) 50%/0 0 no-repeat
+                    content-box;
+                border-radius: 50%;
+                outline-offset: calc(var(--check-box-size) / 10);
+                -webkit-appearance: none;
+                -moz-appearance: none;
+                appearance: none;
+                cursor: pointer;
+                font-size: inherit;
+                transition: 0.3s;
+            }
+
+            input[type="radio"]:checked {
+                border-color: var(--check-box-color);
+                background-size: 100% 100%;
+            }
+
+            input[type="radio"]:disabled {
+                background: linear-gradient(#939393 0 0) 50%/100% 20% no-repeat content-box;
+                opacity: 0.5;
+                cursor: not-allowed;
+            }
+
+            label {
+                display: inline-flex;
+                align-items: center;
+                gap: 10px;
+                cursor: pointer;
+                padding: 4px 6px;
+                border-radius: 4px;
+            }
+
+            @media (max-width: 767px) {
+                input[type="radio"],
+                label {
+                    cursor: default;
+                }
+
+                #quiz-container {
+                    margin-left: 8px;
+                    margin-right: 8px;
+                }
+            }
+
+            /* PC (Desktop devices) */
+            @media (min-width: 768px) {
+                body {
+                    display: flex;
+                    justify-content: center;
+                }
+
+                main {
+                    max-width: var(--large-device-width);
+                }
+
+                #score-stats-container {
+                    max-width: var(--large-device-width);
+                }
+
+                dialog {
+                    max-width: var(--large-device-width);
+                }
+            }
+
+            @media print {
+                input[type="radio"] {
+                    background: none !important;
+                    border-color: #939393 !important;
+                }
+
+                input[type="radio"]:checked {
+                    border-color: #939393 !important;
+                }
+            }
+
+            .question-lable {
+                display: flex;
+                align-items: center;
+                gap: 8px;
+            }
+
+            button {
+                -webkit-tap-highlight-color: transparent;
+                -webkit-touch-callout: none;
+                -webkit-user-select: none;
+                user-select: none;
+                outline: none;
+                position: relative;
+                overflow: hidden;
+                cursor: pointer;
+            }
+
+            .button {
+                background-color: var(--success-background);
+                border: none;
+                color: #f4f5f7;
+                opacity: 0.8;
+                font-size: 18px;
+                flex-grow: 1;
+                padding: 8px 16px;
+                border-radius: 8px;
+            }
+
+            .button:hover {
+                opacity: 1;
+            }
+
+            .explanation-btn {
+                border: none;
+                color: var(--success);
+                background-color: transparent;
+            }
+
+            #submit-button:active::after {
+                background-color: #ef4444;
+            }
+
+            .single-question-container {
+                background-color: var(--primary-color);
+                display: flex;
+                flex-direction: column;
+                gap: 8px;
+                padding: 16px;
+                border-radius: 8px;
+            }
+
+            #modal-content {
+                padding: 16px;
+                line-height: 24px;
+            }
+
+            dialog::backdrop {
+                background: rgba(0, 0, 0, 0.5);
+            }
+
+            dialog {
+                position: fixed;
+                border: 1px solid var(--border-color);
+                background-color: var(--primary-color);
+                color: rgb(240, 241, 248);
+                padding: 16px;
+                border-radius: 8px;
+                width: 80vw;
+                max-height: 80vh;
+                overflow: auto;
+                top: 50%;
+                left: 50%;
+                -webkit-transform: translateX(-50%) translateY(-50%);
+                -moz-transform: translateX(-50%) translateY(-50%);
+                -ms-transform: translateX(-50%) translateY(-50%);
+                transform: translateX(-50%) translateY(-50%);
+            }
+
+            #close-modal-btn {
+                position: absolute;
+                top: 4px;
+                right: 4px;
+                padding: 2px 8px;
+                border-radius: 2px;
+                border: none;
+                background-color: var(--danger);
+            }
+
+            .correct-answer label {
+                border: 2px solid var(--success);
+                width: 100%;
+            }
+
+            .incorrect-answer label {
+                border: 2px solid var(--danger);
+                width: 100%;
+            }
+
+            .options-container {
+                display: flex;
+                flex-direction: column;
+                gap: 4px;
+            }
+
+            #quiz-meta-container {
+                border-radius: 8px;
+                background-color: var(--primary-color);
+                margin-bottom: 12px;
+                padding: 8px;
+            }
+
+            #quiz-title {
+                text-align: center;
+                font-size: 24px;
+                margin-bottom: 8px;
+            }
+
+            #quiz-description {
+                line-height: 1.5;
+                padding: 2px 6px;
+            }
+        </style>
+    </head>
+
+    <body onload="main()">
+        <main>
+            <section id="quiz-meta-container">
+                <h1 id="quiz-title"></h1>
+                <p id="quiz-description"></p>
+            </section>
+            <section id="score-stats-container">
+                <div id="score-card">
+                    Score: <span id="current-score">999</span> of
+                    <span id="pass-percent">999%</span>
+                </div>
+                <div>Correct: <span id="correct-answers">999</span></div>
+                <div>Incorrect: <span id="wrong-answers">999</span></div>
+            </section>
+
+            <section id="quiz-container"></section>
+
+            <dialog id="modal" class="modal-container">
+                <div id="modal-content">
+                    <p id="modal-text"></p>
+                </div>
+            </dialog>
+        </main>
+
+        <script>
+            const quizData = {"quiz_id": 6180176, "quiz_description": null, "quiz_title": "Quick Quiz", "pass_percent": null, "questions": [{"_class": "assessment", "id": 74731142, "assessment_type": "multiple-choice", "prompt": {"question": "<p>A corporation is revising its security policies to align with current best practices. Which policy should they prioritize updating to ensure compliance with data protection laws?</p>", "relatedLectureIds": "", "feedbacks": ["", "Updating the Information Security Policy should be a priority for the corporation to ensure compliance with current data protection laws. This policy forms the backbone of the organization's security posture, outlining the standards, guidelines, and procedures for protecting sensitive data. While AUP, Business Continuity, and Disaster Recovery plans are important, the Information Security Policy directly addresses the comprehensive security measures and practices that align with legal requirements for data protection.", "", ""], "answers": ["<p>Acceptable Use Policy (AUP)</p>", "<p>Information Security Policy</p>", "<p>Business Continuity Plan</p>", "<p>Disaster Recovery Plan</p>"]}, "correct_response": ["b"], "section": "", "question_plain": "A corporation is revising its security policies to align with current best practices. Which policy should they prioritize updating to ensure compliance with data protection laws?", "related_lectures": []}, {"_class": "assessment", "id": 74731540, "assessment_type": "multiple-choice", "prompt": {"question": "<p>An e-commerce company is expanding globally and needs to ensure compliance with various privacy laws. What aspect of privacy governance should they focus on?</p>", "relatedLectureIds": "", "feedbacks": ["As the e-commerce company expands globally, implementing a robust Data Inventory and Retention policy is critical to comply with various international privacy laws. This policy should address how data is collected, stored, used, and retained, ensuring compliance with regulations like GDPR, which includes provisions like the right to be forgotten. Additionally, it should consider the legal implications and requirements in different regions. ", "", "", ""], "answers": ["<p>Implementing a robust Data Inventory and Retention policy</p>", "<p>Reviewing Physical Security Procedures</p>", "<p>Updating their Change Management Playbook</p>", "<p>Modifying their Access Control Procedures</p>"]}, "correct_response": ["a"], "section": "", "question_plain": "An e-commerce company is expanding globally and needs to ensure compliance with various privacy laws. What aspect of privacy governance should they focus on?", "related_lectures": []}, {"_class": "assessment", "id": 74731548, "assessment_type": "multiple-choice", "prompt": {"question": "<p>A multinational corporation is reviewing its compliance reporting mechanisms. What approach should they prioritize to effectively manage compliance across different regions?</p>", "relatedLectureIds": "", "feedbacks": ["Centralizing the compliance reporting structure is a strategic approach for a multinational corporation to manage compliance effectively across different regions. This approach allows for a unified view of compliance status, enabling better oversight, consistency, and coordination of compliance efforts across various jurisdictions. It helps in identifying and addressing compliance gaps and streamlines the reporting process. While decentralization can offer local flexibility, it may lack the cohesive overview provided by a centralized approach. ", "", "", ""], "answers": ["<p>Centralizing their compliance reporting structure</p>", "<p>Decentralizing their compliance reporting structure</p>", "<p>Focusing solely on internal compliance reporting</p>", "<p>Implementing automated compliance monitoring</p>"]}, "correct_response": ["a"], "section": "", "question_plain": "A multinational corporation is reviewing its compliance reporting mechanisms. What approach should they prioritize to effectively manage compliance across different regions?", "related_lectures": []}, {"_class": "assessment", "id": 74731554, "assessment_type": "multiple-choice", "prompt": {"question": "<p>A tech company is facing fines and reputational damage due to non-compliance with industry standards. What should they implement to prevent future non-compliance?</p>", "relatedLectureIds": "", "feedbacks": ["", "Conducting more thorough Due Diligence and Compliance Monitoring is crucial for the tech company to prevent future non-compliance issues. This involves regularly reviewing and assessing the company\u2019s adherence to relevant industry standards and regulations. Through diligent compliance monitoring, the company can identify and rectify potential compliance issues proactively, thus avoiding fines and protecting its reputation. ", "", ""], "answers": ["<p>Enhancing their Disaster Recovery Plan</p>", "<p>Conducting more thorough Due Diligence and Compliance Monitoring</p>", "<p>Focusing on updating their Business Continuity Plan</p>", "<p>Revising their Physical Security Procedures</p>"]}, "correct_response": ["b"], "section": "", "question_plain": "A tech company is facing fines and reputational damage due to non-compliance with industry standards. What should they implement to prevent future non-compliance?", "related_lectures": []}, {"_class": "assessment", "id": 74731572, "assessment_type": "multiple-choice", "prompt": {"question": "<p>A healthcare organization needs to manage the access and processing of sensitive patient data. What roles should they define to ensure proper data governance?</p>", "relatedLectureIds": "", "feedbacks": ["Defining roles such as Data Owners and Data Processors is critical in a healthcare organization for proper governance of sensitive patient data. Data Owners are responsible for defining the purposes and means of data processing, while Data Processors handle the actual processing of data as per the owners' instructions. ", "", "", ""], "answers": ["<p>Data Owners and Processors</p>", "<p>Centralized IT Committee members</p>", "<p>Decentralized Department Heads</p>", "<p>External Compliance Auditors</p>"]}, "correct_response": ["a"], "section": "", "question_plain": "A healthcare organization needs to manage the access and processing of sensitive patient data. What roles should they define to ensure proper data governance?", "related_lectures": []}]};
+            let correct = new Set();
+            let incorrect = new Set();
+            let totalNumberOfQuestions = 0;
+            const quizTitle = quizData.quiz_title;
+            const quizDescription = quizData.quiz_description;
+            const questionData = quizData.questions;
+            const passPercent = quizData.pass_percent;
+            const modalTextElement = document.getElementById("modal-text");
+            const quizContainerElement = document.getElementById("quiz-container");
+
+            const dialog = document.querySelector("dialog");
+            const showButton = document.getElementById("view-explanatin");
+            const closeButton = document.getElementById("close-modal-btn");
+            const quizTitleElement = document.getElementById("quiz-title");
+            const quizDescriptionElement = document.getElementById("quiz-description");
+
+            function main() {
+                // update quiz meta data
+                document.title = quizTitle;
+                quizTitleElement.innerHTML = quizTitle;
+                quizDescriptionElement.innerHTML = quizDescription;
+
+                const passPercentElement = document.getElementById("pass-percent");
+                passPercentElement.innerHTML = passPercent + "%";
+                totalNumberOfQuestions = questionData.length;
+                // shuffle the questionData to randomize the order of the questions
+                for (let i = questionData.length - 1; i > 0; i--) {
+                    const j = Math.floor(Math.random() * (i + 1));
+                    [questionData[i], questionData[j]] = [questionData[j], questionData[i]];
+                }
+
+                let formattedQuestions = questionData.map(formatSingleQuestionData);
+                updateScore();
+                // display the formattedQuestions
+                formattedQuestions.forEach((question, idx) => {
+                    renderSingleQuestion(question, idx + 1);
+                });
+            }
+
+            /**
+             * Formats the question data from the given QuizData object.
+             *
+             * @param {Object} singleQuizData - The singleQuizData object containing prompt and correct_response.
+             * @return {Object} The formatted question object with the following properties:
+             *   - id: The ID of the question.
+             *   - question: The text of the question.
+             *   - answers: The array of answer options.
+             *   - correctAnswer: The text of the correct answer.
+             *   - explanation: The explanation of the correct answer.
+             */
+            function formatSingleQuestionData(singleQuizData = null) {
+                const { prompt, correct_response, id } = singleQuizData;
+                const questionText = prompt.question;
+                const answers = prompt.answers;
+                const correctAnswer = correct_response[0];
+                const correctAnswerText = answers[correctAnswer.toLowerCase().charCodeAt(0) - 97];
+                const questionObj = {
+                    id: id,
+                    question: questionText,
+                    answers: answers,
+                    correctAnswer: correctAnswerText,
+                    explanation: prompt?.explanation || "",
+                };
+                return questionObj;
+            }
+
+            /**
+             * Renders a single question with its options and submit button.
+             *
+             * @param {Object} singleQuestionData - The data of the question to render.
+             * @param {number} rootIndex - The index of the question in the quiz.
+             * @return {void} return nothing.
+             */
+
+            const renderSingleQuestion = (singleQuestionData = {}, rootIndex = 1) => {
+                const { id, explanation, answers, correctAnswer, question } = singleQuestionData;
+                // shuffle the answers to randomize the order of the answers
+                for (let i = answers.length - 1; i > 0; i--) {
+                    const j = Math.floor(Math.random() * (i + 1));
+                    [answers[i], answers[j]] = [answers[j], answers[i]];
+                }
+                const optionsHTML = answers
+                    .map((option, index) => {
+                        const optionId = `${id}_${index}`;
+
+                        return `
+        <div class="question-lable">
+          <input type="radio" id="${optionId}" name="${"answer"}" value="${option}" />
+          <label for="${optionId}">${option}</label>
+        </div>
+      `;
+                    })
+
+                    .join("");
+
+                const container = document.createElement("div");
+                container.innerHTML = `
+        <form data-correct-answer="${correctAnswer}" data-question-id="${id}" class="single-question-container" onsubmit="submitButtonListener(event)">
+          <div style="display: flex;justify-content: space-between;">
+            <p style="font-weight: 600">Question ${rootIndex}:</p>
+            <button type="button" onclick="renderExplanation(event)" id="${`explanation-${id}`}" data-explanation="${explanation}" class="explanation-btn">View Explanation</button>
+          </div>
+          <p style="margin-bottom: 8px;line-height: 1.5">${question}</p>
+          <div class="options-container">
+            ${optionsHTML}
+          </div>
+          <div style="display: flex; gap: 8px;">
+            <button type="submit" id="submit-button" class="button">Submit</button>
+          </div>
+        </form>
+      `;
+                quizContainerElement.appendChild(container);
+            };
+
+            /**
+             * Updates the score on the page based on the number of correct and incorrect answers.
+             *
+             * @return {void} This function does not return a value.
+             */
+            function updateScore() {
+                const currentParcentageElement = document.getElementById("current-score");
+                const correctAnswerElement = document.getElementById("correct-answers");
+                const wrongAnswerElement = document.getElementById("wrong-answers");
+                correctAnswerElement.innerHTML = correct.size;
+                wrongAnswerElement.innerHTML = incorrect.size;
+                const score = Number((correct.size / totalNumberOfQuestions) * 100).toFixed(2);
+                currentParcentageElement.innerHTML = score;
+            }
+
+            /**
+             * Handles the event when the submit button is clicked.
+             *
+             * @param {Event} e - The event object.
+             * @return {void} This function does not return anything.
+             */
+            const submitButtonListener = (e) => {
+                e.preventDefault();
+                const formData = new FormData(e.target);
+                const form = e.target;
+                const selectedOption = e.target.querySelector('input[type="radio"]:checked');
+                if (!selectedOption) {
+                    alert("Please select an answer!");
+                    return;
+                }
+
+                let isCorrect = false;
+                const { answer: userAnswer } = Object.fromEntries(formData.entries());
+                const correctAnswer = e.target.dataset.correctAnswer;
+                const questionId = e.target.dataset.questionId;
+                if (userAnswer == correctAnswer) {
+                    correct.add(questionId);
+                    incorrect.delete(questionId);
+                    isCorrect = true;
+                } else {
+                    incorrect.add(e.target.dataset.questionId);
+                    correct.delete(questionId);
+                }
+                updateScore();
+
+                const resultClass = isCorrect ? "correct-answer" : "incorrect-answer";
+
+                form.querySelectorAll(".question-lable").forEach((label) => {
+                    label.classList.remove("correct-answer", "incorrect-answer");
+                });
+                selectedOption.closest(".question-lable").classList.add(resultClass);
+            };
+
+            function renderExplanation(ev) {
+                modalTextElement.innerHTML = ev.target.dataset?.explanation || "no explanation found";
+                dialog.showModal();
+                dialog.addEventListener("click", (event) => {
+                    if (event.target === dialog) {
+                        dialog.close();
+                    }
+                });
+            }
+        </script>
+    </body>
+</html>

21 - Risk Management/001 Risk Terms OB 5.2_en.srt

@@ -0,0 +1,416 @@
+1
+00:00:00,000 --> 00:00:03,000
+Everything we do in life has risks.
+
+2
+00:00:03,000 --> 00:00:05,000
+Now, what exactly is risk?
+
+3
+00:00:05,000 --> 00:00:08,000
+Well, in this section I want to define risk.
+
+4
+00:00:08,000 --> 00:00:12,000
+And I want to go through some terms with you guys that you should be familiar with.
+
+5
+00:00:12,000 --> 00:00:14,000
+So first of all, what exactly is risk.
+
+6
+00:00:14,000 --> 00:00:19,000
+Well, risk is the probability of a threat exploiting a vulnerability.
+
+7
+00:00:19,000 --> 00:00:22,000
+That's a generic definition of risk.
+
+8
+00:00:22,000 --> 00:00:28,000
+The first thing we want to talk about is risk is is probable risk is not guaranteed to happen if something
+
+9
+00:00:28,000 --> 00:00:29,000
+is considered to be a risk.
+
+10
+00:00:29,000 --> 00:00:34,000
+We're basically we're saying that this thing might or might not happen.
+
+11
+00:00:34,000 --> 00:00:37,000
+If it's 100% sure it's going to happen, it's not considered a risk.
+
+12
+00:00:37,000 --> 00:00:40,000
+Now, if it's probable, it's going to be a risk.
+
+13
+00:00:40,000 --> 00:00:41,000
+But what exactly is a risk?
+
+14
+00:00:41,000 --> 00:00:46,000
+Well, basically a risk is basically a threat exploiting a vulnerability.
+
+15
+00:00:47,000 --> 00:00:49,000
+This looks like a formula.
+
+16
+00:00:49,000 --> 00:00:53,000
+And it is, but it's not really a numerical formula.
+
+17
+00:00:53,000 --> 00:00:56,000
+It's just more of a formula that tells you how to calculate risk.
+
+18
+00:00:56,000 --> 00:01:03,000
+For example, if there is a particular threat like a hacker and there is a vulnerability because you
+
+19
+00:01:03,000 --> 00:01:08,000
+don't have firewalls on your network and there's a hacker that wants to exploit your network, well,
+
+20
+00:01:08,000 --> 00:01:10,000
+that's a high threat.
+
+21
+00:01:10,000 --> 00:01:11,000
+That's a big vulnerability.
+
+22
+00:01:11,000 --> 00:01:13,000
+There's a very high risk.
+
+23
+00:01:13,000 --> 00:01:19,000
+But what if the hacker exploits a particular hole on your network and you patch up that particular hole?
+
+24
+00:01:20,000 --> 00:01:22,000
+Well, the hacker still exists.
+
+25
+00:01:22,000 --> 00:01:25,000
+There's still a threat, but there's no vulnerability.
+
+26
+00:01:25,000 --> 00:01:27,000
+And anything times zero is basically zero.
+
+27
+00:01:27,000 --> 00:01:29,000
+So basically this risk may not exist.
+
+28
+00:01:29,000 --> 00:01:36,000
+In other words, the risk of him coming through port 21 is no more because you put a firewall on it,
+
+29
+00:01:36,000 --> 00:01:37,000
+blocked that particular port.
+
+30
+00:01:37,000 --> 00:01:44,000
+So when it comes to risk management, we have to ensure that we manage the threats and the vulnerabilities
+
+31
+00:01:44,000 --> 00:01:46,000
+in order to reduce or eliminate risks.
+
+32
+00:01:46,000 --> 00:01:50,000
+Now security is known to be risk based.
+
+33
+00:01:50,000 --> 00:01:57,000
+You see, all the actions we take in security should be done from a risk based approach.
+
+34
+00:01:57,000 --> 00:01:58,000
+What does that mean?
+
+35
+00:01:58,000 --> 00:02:05,000
+You see a risk based approach to security is that the controls we implement is going to be selected
+
+36
+00:02:05,000 --> 00:02:06,000
+based on a risk assessment.
+
+37
+00:02:06,000 --> 00:02:08,000
+Let me just tell you guys something.
+
+38
+00:02:08,000 --> 00:02:12,000
+You can't spend $10 protecting $5.
+
+39
+00:02:12,000 --> 00:02:17,000
+Every control that we implement in IT security is probably going to cost money.
+
+40
+00:02:17,000 --> 00:02:22,000
+And we have to ensure that what we're spending is protecting the asset, that it's actually worth it.
+
+41
+00:02:22,000 --> 00:02:26,000
+In other words, is the $10 that we're spending worth protecting $5?
+
+42
+00:02:26,000 --> 00:02:28,000
+How do we even come up with the value of the asset?
+
+43
+00:02:28,000 --> 00:02:32,000
+So risks of itself, risk assessment can get complex.
+
+44
+00:02:32,000 --> 00:02:34,000
+That's what this whole section is about.
+
+45
+00:02:34,000 --> 00:02:41,000
+Now, before we get into all the different risk assessments and how to respond to it, I want to cover
+
+46
+00:02:41,000 --> 00:02:43,000
+some terms that we're going to be using later.
+
+47
+00:02:43,000 --> 00:02:44,000
+The first thing up we have is an asset.
+
+48
+00:02:44,000 --> 00:02:47,000
+This is anything an environment that needs to be protected.
+
+49
+00:02:47,000 --> 00:02:49,000
+It's anything in the environment that generally has a value.
+
+50
+00:02:49,000 --> 00:02:53,000
+Of course, the most important asset in it is human life.
+
+51
+00:02:53,000 --> 00:02:54,000
+That's correct.
+
+52
+00:02:54,000 --> 00:02:58,000
+If you said that second most important is probably going to be data, then you have things like physical
+
+53
+00:02:58,000 --> 00:03:02,000
+structures like servers, computers, physical buildings and so on.
+
+54
+00:03:02,000 --> 00:03:06,000
+The asset valuation, this is something that you have to calculate.
+
+55
+00:03:06,000 --> 00:03:10,000
+Well, you can't really do a risk assessment if you don't know the value of the asset.
+
+56
+00:03:10,000 --> 00:03:17,000
+Once again, if you don't know the asset is worth $5, how are you doing an assessment to then go and
+
+57
+00:03:17,000 --> 00:03:20,000
+spend $1,020 protecting this $5 asset.
+
+58
+00:03:20,000 --> 00:03:22,000
+So you have to know the value of the asset.
+
+59
+00:03:22,000 --> 00:03:28,000
+This is a dollar value assigned to an asset based on the actual cost and non-monetary expenses.
+
+60
+00:03:28,000 --> 00:03:32,000
+In the world of risk, you have to know your threats.
+
+61
+00:03:32,000 --> 00:03:35,000
+Any potential occurrence that may harm the asset.
+
+62
+00:03:35,000 --> 00:03:42,000
+Threats can be not just people think hackers and viruses, but threats can also be things like physical
+
+63
+00:03:42,000 --> 00:03:46,000
+things, physical threats like a hurricane or a flood.
+
+64
+00:03:47,000 --> 00:03:49,000
+Threat agents and threat actors.
+
+65
+00:03:49,000 --> 00:03:53,000
+Those are people programs, hardware systems that uses threats to cause harm.
+
+66
+00:03:53,000 --> 00:03:57,000
+So a threat agent or an actor is basically a hacker.
+
+67
+00:03:57,000 --> 00:04:01,000
+The threat event are occurrences that lead to the exploitation.
+
+68
+00:04:01,000 --> 00:04:05,000
+So them hacking your system is considered a threat event.
+
+69
+00:04:05,000 --> 00:04:06,000
+What's a threat vector?
+
+70
+00:04:06,000 --> 00:04:08,000
+Well, how did they hack your system?
+
+71
+00:04:08,000 --> 00:04:10,000
+What vector did they use?
+
+72
+00:04:10,000 --> 00:04:14,000
+Well, that's the path or means by which the attacker can gain access.
+
+73
+00:04:14,000 --> 00:04:18,000
+So a threat vector for example is going to be like an internet line.
+
+74
+00:04:20,000 --> 00:04:24,000
+Vulnerability is a weakness in the asset or the absence of the weakness.
+
+75
+00:04:25,000 --> 00:04:29,000
+Uh, or the absent or the weakness of a safeguard or countermeasure.
+
+76
+00:04:29,000 --> 00:04:30,000
+So what is the vulnerability?
+
+77
+00:04:30,000 --> 00:04:31,000
+It's a hole in your system.
+
+78
+00:04:31,000 --> 00:04:33,000
+It's a weakness in your system.
+
+79
+00:04:33,000 --> 00:04:35,000
+It's the absence of a safeguard in your system.
+
+80
+00:04:35,000 --> 00:04:41,000
+For example, not have an antivirus, not having a firewall, uh, not training your users.
+
+81
+00:04:41,000 --> 00:04:45,000
+Those are going to be absence of a particular safeguard.
+
+82
+00:04:46,000 --> 00:04:50,000
+Exposure that is the actual or anticipated damage.
+
+83
+00:04:50,000 --> 00:04:54,000
+So, for example, when the threat exploits the vulnerability, when a hacker comes in, when the malware
+
+84
+00:04:54,000 --> 00:04:56,000
+comes in, how much is lost?
+
+85
+00:04:56,000 --> 00:04:58,000
+That's your exposure.
+
+86
+00:04:58,000 --> 00:05:01,000
+Safeguard is what we put in place to reduce the risk or eliminate the risk.
+
+87
+00:05:01,000 --> 00:05:05,000
+This is going to be like putting an antivirus or training your user.
+
+88
+00:05:05,000 --> 00:05:10,000
+The attack is when the threat attempts to exploit the vulnerability and if they're successful, it's
+
+89
+00:05:10,000 --> 00:05:11,000
+called a breach.
+
+90
+00:05:11,000 --> 00:05:17,000
+Now I want you guys to know the difference breach is the occurrence of a security mechanism being bypassed.
+
+91
+00:05:17,000 --> 00:05:24,000
+So if an attacker, a hacker, tries to break into your network, that's called the attack where they
+
+92
+00:05:24,000 --> 00:05:25,000
+successful.
+
+93
+00:05:25,000 --> 00:05:26,000
+Maybe.
+
+94
+00:05:26,000 --> 00:05:27,000
+Maybe not.
+
+95
+00:05:27,000 --> 00:05:28,000
+If they are, it's considered a breach.
+
+96
+00:05:28,000 --> 00:05:32,000
+So when we say security breach, that is generally a successful attack.
+
+97
+00:05:32,000 --> 00:05:38,000
+Now keep in mind once again guys, everything we do in IT security is a risk based thing.
+
+98
+00:05:38,000 --> 00:05:40,000
+We should not be doing anything in IT security.
+
+99
+00:05:40,000 --> 00:05:43,000
+If we haven't done a risk assessment, we can't.
+
+100
+00:05:43,000 --> 00:05:45,000
+We shouldn't select controls.
+
+101
+00:05:45,000 --> 00:05:47,000
+If we haven't done a risk assessment.
+
+102
+00:05:47,000 --> 00:05:51,000
+Without the risk assessment, we may be spending money protecting things that just don't need it or
+
+103
+00:05:51,000 --> 00:05:53,000
+it just doesn't have any value.
+
+104
+00:05:53,000 --> 00:05:55,000
+So let's get started with these risk assessments.
+

21 - Risk Management/002 Risk Identification and Assessment Times OB 5.2_en.srt

@@ -0,0 +1,340 @@
+1
+00:00:00,000 --> 00:00:04,000
+When it comes to risk management, one of the first things you're going to be doing is, of course,
+
+2
+00:00:04,000 --> 00:00:07,000
+identifying the risks that can affect your network.
+
+3
+00:00:07,000 --> 00:00:14,000
+Now, risk identification is understanding the initial phase of risk management where the potential
+
+4
+00:00:14,000 --> 00:00:17,000
+security risks are recognized and described.
+
+5
+00:00:17,000 --> 00:00:18,000
+Now I want to just point out something.
+
+6
+00:00:18,000 --> 00:00:22,000
+Risk identification is not something that's a solo activity.
+
+7
+00:00:22,000 --> 00:00:27,000
+Risk identification should be done by all members of the IT department, or most members of the IT department
+
+8
+00:00:27,000 --> 00:00:29,000
+and other departments.
+
+9
+00:00:29,000 --> 00:00:34,000
+The more people involved in it, the more perspectives you get.
+
+10
+00:00:34,000 --> 00:00:40,000
+Generally speaking, IT folks may be able to identify risks related to the IT department, but they're
+
+11
+00:00:40,000 --> 00:00:45,000
+probably not going to be able to identify certain risks that can affect the accounting department or
+
+12
+00:00:45,000 --> 00:00:47,000
+the sales department.
+
+13
+00:00:47,000 --> 00:00:47,000
+Why?
+
+14
+00:00:47,000 --> 00:00:49,000
+Because the IT folks generally don't work there.
+
+15
+00:00:49,000 --> 00:00:55,000
+So the more people that gets involved, the more likely your risk identification is going to be more
+
+16
+00:00:55,000 --> 00:00:56,000
+comprehensive.
+
+17
+00:00:56,000 --> 00:01:02,000
+So the whole point of risk identification is just coming up with a list of risks that can affect us.
+
+18
+00:01:02,000 --> 00:01:03,000
+Like what?
+
+19
+00:01:03,000 --> 00:01:08,000
+Well, we can already think of most risks, such as hackers hacking into the network and stealing our
+
+20
+00:01:08,000 --> 00:01:08,000
+data.
+
+21
+00:01:08,000 --> 00:01:13,000
+Ransomware, uh, modifying and encrypting the data.
+
+22
+00:01:13,000 --> 00:01:16,000
+But what about regulatory risks, like being out of compliance?
+
+23
+00:01:16,000 --> 00:01:18,000
+The risk of being out of compliance?
+
+24
+00:01:18,000 --> 00:01:24,000
+What about risks to the supply chain of a of a vendor going away or a vendor going down?
+
+25
+00:01:24,000 --> 00:01:29,000
+What about physical security risks such as the drop of infrastructure such as not having power?
+
+26
+00:01:29,000 --> 00:01:34,000
+Those are all different kinds of risks that needs to identify needs to be identified.
+
+27
+00:01:34,000 --> 00:01:39,000
+This is critical for establishing a baseline from which risk analysis, assessment and strategies are
+
+28
+00:01:39,000 --> 00:01:39,000
+done.
+
+29
+00:01:40,000 --> 00:01:46,000
+Now, when it comes to risk assessment themselves, there are a few different ways of doing it.
+
+30
+00:01:46,000 --> 00:01:51,000
+One kind of risk assessment is called an ad hoc risk assessment.
+
+31
+00:01:51,000 --> 00:01:53,000
+This is performed as needed.
+
+32
+00:01:53,000 --> 00:01:57,000
+Generally responds to a specific event or change in the environment.
+
+33
+00:01:57,000 --> 00:02:03,000
+For example, it might be conducted after a major security breach, or it could be conducted after a
+
+34
+00:02:03,000 --> 00:02:05,000
+natural disaster that no one thought about.
+
+35
+00:02:05,000 --> 00:02:10,000
+For example, there was a major flood next to a data center or a particular office that no one ever
+
+36
+00:02:10,000 --> 00:02:12,000
+taught, that that area ever gets flooded.
+
+37
+00:02:12,000 --> 00:02:14,000
+So you could come out and just do an ad hoc assessment.
+
+38
+00:02:14,000 --> 00:02:16,000
+Basically, there's no plan for it.
+
+39
+00:02:16,000 --> 00:02:18,000
+You just do it when it's needed.
+
+40
+00:02:19,000 --> 00:02:24,000
+Now, most companies have what's called reoccurring risk assessments.
+
+41
+00:02:24,000 --> 00:02:29,000
+This is the kind of assessment is conducted at regular intervals, for example, monthly or quarterly
+
+42
+00:02:29,000 --> 00:02:30,000
+or annually.
+
+43
+00:02:30,000 --> 00:02:35,000
+At a minimum, risk assessment should be done once a year at a minimum.
+
+44
+00:02:35,000 --> 00:02:41,000
+Reoccurring risk assessment are generally part of a good systematic approach to managing risks.
+
+45
+00:02:41,000 --> 00:02:44,000
+Now this one here is a good way of doing it.
+
+46
+00:02:45,000 --> 00:02:46,000
+Yearly, at a minimum.
+
+47
+00:02:46,000 --> 00:02:47,000
+Quarterly.
+
+48
+00:02:47,000 --> 00:02:49,000
+Monthly sounds better.
+
+49
+00:02:49,000 --> 00:02:53,000
+There are times when you're just going to do a one time risk assessment.
+
+50
+00:02:53,000 --> 00:02:58,000
+This is generally conducted for specific scenarios, such as if you're launching like a brand new IT
+
+51
+00:02:58,000 --> 00:03:02,000
+product, you may just do this one time thing because you're not going to launch that product again
+
+52
+00:03:02,000 --> 00:03:04,000
+because it's just going to stay in the marketplace.
+
+53
+00:03:04,000 --> 00:03:08,000
+So for example, when implementing a new system or releasing a new product.
+
+54
+00:03:08,000 --> 00:03:13,000
+Now this is one thing we got to keep in mind is that risk assessment is continuous.
+
+55
+00:03:13,000 --> 00:03:15,000
+It's never something you stop.
+
+56
+00:03:15,000 --> 00:03:17,000
+You continuously do it over and over.
+
+57
+00:03:17,000 --> 00:03:18,000
+Why?
+
+58
+00:03:18,000 --> 00:03:21,000
+Because the world changes and there's new risk every day.
+
+59
+00:03:21,000 --> 00:03:25,000
+Every single day you wake up, there's a new risk that can take your life away.
+
+60
+00:03:25,000 --> 00:03:28,000
+There's a new risk that can bring your company down.
+
+61
+00:03:28,000 --> 00:03:31,000
+So we have to consistently keep doing risk assessment.
+
+62
+00:03:31,000 --> 00:03:35,000
+So remember the first step in that assessment is going to be identifying those risks.
+
+63
+00:03:35,000 --> 00:03:40,000
+Then we have to analyze those risks which will take a look at in the next video.
+
+64
+00:03:41,000 --> 00:03:45,000
+So ongoing monitoring and analysis and analysis of risks.
+
+65
+00:03:45,000 --> 00:03:46,000
+This approach.
+
+66
+00:03:46,000 --> 00:03:49,000
+This approach will use real time data and automated tools.
+
+67
+00:03:49,000 --> 00:03:52,000
+Continuous assessment are becoming increasingly important.
+
+68
+00:03:52,000 --> 00:03:52,000
+Why?
+
+69
+00:03:52,000 --> 00:03:53,000
+Because.
+
+70
+00:03:54,000 --> 00:03:54,000
+It.
+
+71
+00:03:54,000 --> 00:03:56,000
+Security is dynamic.
+
+72
+00:03:56,000 --> 00:03:56,000
+All right.
+
+73
+00:03:56,000 --> 00:03:58,000
+What we do in this world is dynamic.
+
+74
+00:03:58,000 --> 00:03:59,000
+Everything changes.
+
+75
+00:03:59,000 --> 00:04:06,000
+New threats, new technology, new management, new people, new laws, new governments on a consistent
+
+76
+00:04:06,000 --> 00:04:07,000
+basis.
+
+77
+00:04:07,000 --> 00:04:09,000
+The world is not static.
+
+78
+00:04:09,000 --> 00:04:12,000
+So your assessment can't be static.
+
+79
+00:04:12,000 --> 00:04:13,000
+All right, keep that in mind.
+
+80
+00:04:14,000 --> 00:04:18,000
+Keep that in mind that you're going to be doing risk assessment on a continuous basis.
+
+81
+00:04:18,000 --> 00:04:22,000
+There are times when you might do a one time assessment for a particular launch of a new product.
+
+82
+00:04:22,000 --> 00:04:27,000
+Keep in mind that it's continuous and it probably should be done every quarterly in my opinion, or
+
+83
+00:04:27,000 --> 00:04:30,000
+monthly, but at least do it every yearly.
+
+84
+00:04:31,000 --> 00:04:32,000
+Uh, you know why?
+
+85
+00:04:32,000 --> 00:04:35,000
+Because risk is something that changes all the time.
+

21 - Risk Management/003 Quantitative and Qualitive Risk Assessment OB 5.2_en.srt

@@ -0,0 +1,784 @@
+1
+00:00:00,000 --> 00:00:05,000
+When you conduct a risk assessment, you're either going to be doing what's called a quantitative assessment
+
+2
+00:00:05,000 --> 00:00:07,000
+or a qualitative assessment.
+
+3
+00:00:07,000 --> 00:00:13,000
+Quantitative assessment is when you numerically analyze risk and you run a series of formulas for that
+
+4
+00:00:13,000 --> 00:00:18,000
+versus quantitative assessment is a more subjective kind of a risk assessment, in which case you're
+
+5
+00:00:18,000 --> 00:00:23,000
+going to be using things such as high, medium, low or verbally describing risks.
+
+6
+00:00:23,000 --> 00:00:30,000
+So quantitative assessment is when you're going to use numbers, actual hard numbers in order to do
+
+7
+00:00:30,000 --> 00:00:32,000
+your risk assessment.
+
+8
+00:00:32,000 --> 00:00:33,000
+Let me give you an example.
+
+9
+00:00:33,000 --> 00:00:37,000
+In the world of risk assessment, an earthquake in New York City, what's the probability?
+
+10
+00:00:37,000 --> 00:00:43,000
+Well, for quantitative, you might say the probability of an earthquake or a major earthquake in New
+
+11
+00:00:43,000 --> 00:00:49,000
+York City is low versus in a quantitative assessment, you're going to say, well, it's a 1% every
+
+12
+00:00:49,000 --> 00:00:50,000
+year.
+
+13
+00:00:50,000 --> 00:00:54,000
+If you actually look it up, it's actually one out of a one out of 100 chance.
+
+14
+00:00:54,000 --> 00:00:56,000
+You get an earthquake every year.
+
+15
+00:00:56,000 --> 00:00:57,000
+Major earthquake in New York City.
+
+16
+00:00:57,000 --> 00:01:01,000
+If you say, well, what's the impact of a major earthquake in New York City?
+
+17
+00:01:01,000 --> 00:01:06,000
+Qualitative assessment is going to say something like, well, it's a high impact versus quantitative
+
+18
+00:01:06,000 --> 00:01:12,000
+assessment is going to be, well, it's going to cost $50 billion in damages.
+
+19
+00:01:12,000 --> 00:01:15,000
+You notice one is more objective based.
+
+20
+00:01:15,000 --> 00:01:20,000
+That's going to be the quantitative assessment versus one is very subjective based.
+
+21
+00:01:20,000 --> 00:01:22,000
+That's going to be the qualitative assessment.
+
+22
+00:01:22,000 --> 00:01:27,000
+One needs massive amounts of data and computation and calculations.
+
+23
+00:01:27,000 --> 00:01:30,000
+That's going to be quantitative assessment because of the numbers.
+
+24
+00:01:30,000 --> 00:01:33,000
+You're going to have to go and grab data from all kinds of sources.
+
+25
+00:01:33,000 --> 00:01:41,000
+And that makes it very, very objective versus something where we just use people's opinion and their
+
+26
+00:01:41,000 --> 00:01:41,000
+experience.
+
+27
+00:01:41,000 --> 00:01:45,000
+That's going to be more subjective, like qualitative assessment.
+
+28
+00:01:45,000 --> 00:01:50,000
+Now, I do recommend to watch this video twice because when it comes to quantitative assessment, there's
+
+29
+00:01:50,000 --> 00:01:53,000
+a series of formulas that you're going to need to know for your exam.
+
+30
+00:01:53,000 --> 00:01:54,000
+So let's take a look.
+
+31
+00:01:54,000 --> 00:01:57,000
+So here is a series of formulas.
+
+32
+00:01:57,000 --> 00:02:03,000
+And it's basically only two formulas Excel and Ali I'll come to this one value to safeguard coming up
+
+33
+00:02:03,000 --> 00:02:03,000
+later.
+
+34
+00:02:04,000 --> 00:02:11,000
+But I want to point out something before I get started with this, uh, asset value exposure factor.
+
+35
+00:02:11,000 --> 00:02:16,000
+An annual rate of occurrence of the Aro are not numbers that you can calculate.
+
+36
+00:02:16,000 --> 00:02:19,000
+This has to be given to you in a question.
+
+37
+00:02:19,000 --> 00:02:23,000
+And then you can calculate the SL and the Ala.
+
+38
+00:02:24,000 --> 00:02:24,000
+All right.
+
+39
+00:02:24,000 --> 00:02:25,000
+So keep that in mind.
+
+40
+00:02:26,000 --> 00:02:27,000
+Okay.
+
+41
+00:02:27,000 --> 00:02:28,000
+So let's go through this.
+
+42
+00:02:28,000 --> 00:02:30,000
+I'm going to come up with a scenario.
+
+43
+00:02:30,000 --> 00:02:32,000
+Now don't worry too much about the numbers in this scenario.
+
+44
+00:02:32,000 --> 00:02:36,000
+All I need you to do is to be able to calculate the formulas for your exam.
+
+45
+00:02:36,000 --> 00:02:37,000
+So let's get started.
+
+46
+00:02:37,000 --> 00:02:42,000
+So remember quantitative analysis is all about numerical analysis.
+
+47
+00:02:42,000 --> 00:02:44,000
+It's all about numerically analyzing risk.
+
+48
+00:02:44,000 --> 00:02:47,000
+It's about putting a dollar value on the risk.
+
+49
+00:02:47,000 --> 00:02:48,000
+So let's get started.
+
+50
+00:02:48,000 --> 00:02:52,000
+So let's say you have an asset and that asset has to have a value.
+
+51
+00:02:52,000 --> 00:02:56,000
+So your first thing you have to do in risk assessment is you have to know the value of the asset.
+
+52
+00:02:56,000 --> 00:02:58,000
+Let's say the asset is data.
+
+53
+00:02:58,000 --> 00:03:03,000
+And your data is worth, uh, $1 million.
+
+54
+00:03:03,000 --> 00:03:04,000
+All right.
+
+55
+00:03:04,000 --> 00:03:05,000
+So $1 million.
+
+56
+00:03:06,000 --> 00:03:06,000
+All right.
+
+57
+00:03:06,000 --> 00:03:08,000
+Don't ask me where I get the number from.
+
+58
+00:03:08,000 --> 00:03:10,000
+Remember, this number has to be given to you on the exam.
+
+59
+00:03:10,000 --> 00:03:12,000
+You can't make it up.
+
+60
+00:03:12,000 --> 00:03:14,000
+So it's it's $1 million asset.
+
+61
+00:03:14,000 --> 00:03:16,000
+Now the exposure factor.
+
+62
+00:03:16,000 --> 00:03:17,000
+Notice terme.
+
+63
+00:03:17,000 --> 00:03:24,000
+The exposure factor is a percentage of loss that an organization would experience if a specific asset
+
+64
+00:03:24,000 --> 00:03:26,000
+were violated by a risk.
+
+65
+00:03:26,000 --> 00:03:28,000
+So it's a percentage.
+
+66
+00:03:28,000 --> 00:03:32,000
+If I come in here and I put 100%.
+
+67
+00:03:33,000 --> 00:03:41,000
+What that means is that if this risk, know, the risk we're talking about is malware to data.
+
+68
+00:03:41,000 --> 00:03:43,000
+So malware infecting data is the risk.
+
+69
+00:03:43,000 --> 00:03:51,000
+So if the malware infects your data, how much of or percentage of the data would be lost?
+
+70
+00:03:51,000 --> 00:03:53,000
+I'm saying it's 100%.
+
+71
+00:03:53,000 --> 00:03:57,000
+In other words, if you get infected with malware, all your data is gone.
+
+72
+00:03:57,000 --> 00:04:01,000
+This exposure factor can change though.
+
+73
+00:04:01,000 --> 00:04:08,000
+For example, if you had a data center that's worth or a build and worth $1 million and a category five
+
+74
+00:04:08,000 --> 00:04:16,000
+hurricane would destroy 50% of it, so then a 50% loss so your exposure factor wouldn't be 150%.
+
+75
+00:04:16,000 --> 00:04:18,000
+And then how much of the building would you lose?
+
+76
+00:04:18,000 --> 00:04:23,000
+Well, if it's worth $1 million and you and you're going to lose 50%, then it's worth 500,000.
+
+77
+00:04:23,000 --> 00:04:24,000
+And that's called the SLA.
+
+78
+00:04:25,000 --> 00:04:32,000
+The SLA is the cost associated with every single realized risk against an asset.
+
+79
+00:04:32,000 --> 00:04:41,000
+So the SLA is equal to the asset value, which we have is 1 million times the actual 100%.
+
+80
+00:04:41,000 --> 00:04:48,000
+So if we know 1 million times, 100% is basically 100% is one, so it would be equal to 1 million.
+
+81
+00:04:48,000 --> 00:04:56,000
+We're saying is that every single, every single time you get hit with malware, you're going to lose
+
+82
+00:04:56,000 --> 00:04:57,000
+$1 million.
+
+83
+00:04:57,000 --> 00:05:04,000
+You're going to lose all your data versus if you had a build in that was worth a million and a hurricane
+
+84
+00:05:04,000 --> 00:05:07,000
+is going to destroy 50%, it'll be 500 for you.
+
+85
+00:05:07,000 --> 00:05:13,000
+Now, the next thing is, how often is this going to happen, right?
+
+86
+00:05:13,000 --> 00:05:20,000
+How many times every single year are you going to get hit with a particular virus?
+
+87
+00:05:20,000 --> 00:05:25,000
+Now, technically, you should do this before the virus protection is implemented.
+
+88
+00:05:25,000 --> 00:05:28,000
+And after, let's say you have no virus protection.
+
+89
+00:05:28,000 --> 00:05:35,000
+Let's say you don't have any antivirus, no user training, anti-malware, firewall, nothing.
+
+90
+00:05:35,000 --> 00:05:37,000
+You don't have anything.
+
+91
+00:05:37,000 --> 00:05:39,000
+How many times a year are you going to get a virus?
+
+92
+00:05:40,000 --> 00:05:45,000
+Let's say you get a virus at least once a week, 50 times a year.
+
+93
+00:05:45,000 --> 00:05:45,000
+All right.
+
+94
+00:05:45,000 --> 00:05:47,000
+Because you don't have any protection you're going to get.
+
+95
+00:05:47,000 --> 00:05:49,000
+At least I'm going to go with a minimum.
+
+96
+00:05:49,000 --> 00:05:50,000
+I'm going to say 50.
+
+97
+00:05:50,000 --> 00:05:54,000
+You guys are probably saying, well, it's like every day, let's just go with 50 for now.
+
+98
+00:05:54,000 --> 00:05:54,000
+Okay.
+
+99
+00:05:54,000 --> 00:06:00,000
+So we're saying that, hey, you're going to get at least 50 infection a year.
+
+100
+00:06:00,000 --> 00:06:02,000
+So how much are you going to lose every year.
+
+101
+00:06:02,000 --> 00:06:04,000
+Well that's the annualized loss expectancy.
+
+102
+00:06:04,000 --> 00:06:12,000
+This is a formula is equal to the SLA which is 1 million times the R0.
+
+103
+00:06:12,000 --> 00:06:14,000
+So the R0 is 50 right.
+
+104
+00:06:14,000 --> 00:06:15,000
+So 1 million times 50.
+
+105
+00:06:16,000 --> 00:06:18,000
+This is $50 million.
+
+106
+00:06:18,000 --> 00:06:22,000
+So we know that we're going to lose 50 million every year.
+
+107
+00:06:22,000 --> 00:06:28,000
+Another way to calculate the SLA is basically you know SLA is equal to AV times F.
+
+108
+00:06:28,000 --> 00:06:33,000
+So they're just uh uh, spelling that out for you.
+
+109
+00:06:33,000 --> 00:06:38,000
+You can say AV times F times R0, but the real form is SLA, times R0 gives you the same thing.
+
+110
+00:06:38,000 --> 00:06:39,000
+So it's $50 million.
+
+111
+00:06:39,000 --> 00:06:41,000
+What is this number mean.
+
+112
+00:06:41,000 --> 00:06:51,000
+Well that $50 million means that every single year you're going to lose $50 million, right?
+
+113
+00:06:52,000 --> 00:06:54,000
+You're going to lose 50 million bucks.
+
+114
+00:06:54,000 --> 00:06:55,000
+Why?
+
+115
+00:06:55,000 --> 00:06:57,000
+Because you have no anti-virus protection.
+
+116
+00:06:57,000 --> 00:07:00,000
+Now, this are the formulas.
+
+117
+00:07:00,000 --> 00:07:01,000
+So the asset.
+
+118
+00:07:01,000 --> 00:07:02,000
+Let's do a quick review.
+
+119
+00:07:02,000 --> 00:07:04,000
+The asset value is a number that's given to you.
+
+120
+00:07:04,000 --> 00:07:05,000
+You can't calculate it.
+
+121
+00:07:05,000 --> 00:07:12,000
+So whatever the asset is worth to the business the exposure factor is a percentage of loss when or and
+
+122
+00:07:12,000 --> 00:07:17,000
+when if a risk materializes, how much of the asset is lost in percentage.
+
+123
+00:07:17,000 --> 00:07:23,000
+Single loss expectancy is the asset value times the exposure factor.
+
+124
+00:07:23,000 --> 00:07:26,000
+Then how many times a year would a potential thing occur?
+
+125
+00:07:26,000 --> 00:07:28,000
+That's going to be the R0.
+
+126
+00:07:28,000 --> 00:07:30,000
+So in our ones we have 50.
+
+127
+00:07:30,000 --> 00:07:33,000
+Then the annualized loss expectancy is the asset times the R0.
+
+128
+00:07:34,000 --> 00:07:38,000
+Now I have something at the bottom the annual cost of the safeguard.
+
+129
+00:07:38,000 --> 00:07:40,000
+We have to calculate.
+
+130
+00:07:40,000 --> 00:07:45,000
+Well you go to management and you tell management well we're going to lose $50 million a year.
+
+131
+00:07:45,000 --> 00:07:47,000
+And management says, oh that's a lot of money.
+
+132
+00:07:47,000 --> 00:07:53,000
+Okay, let's go and spend some money and protect our protect those data.
+
+133
+00:07:53,000 --> 00:07:59,000
+So management we come out and we need antivirus user training and firewall.
+
+134
+00:07:59,000 --> 00:08:03,000
+So the annual cost of the safeguard is not a number you can calculate.
+
+135
+00:08:03,000 --> 00:08:05,000
+This is going to be let's say 10 million.
+
+136
+00:08:05,000 --> 00:08:08,000
+So 10 million.
+
+137
+00:08:08,000 --> 00:08:16,000
+Now, when you get the actual, uh, value of the safeguard, now you can recalculate your ale.
+
+138
+00:08:16,000 --> 00:08:19,000
+You see, if you recalculate.
+
+139
+00:08:19,000 --> 00:08:24,000
+Remember when we did this, we said we had no protection in place.
+
+140
+00:08:24,000 --> 00:08:28,000
+Remember that with no protection, you're getting 50 infections.
+
+141
+00:08:28,000 --> 00:08:30,000
+Now, what happens if you do protection?
+
+142
+00:08:30,000 --> 00:08:30,000
+Well.
+
+143
+00:08:31,000 --> 00:08:35,000
+Let's recalculate all these numbers because now we have a protection.
+
+144
+00:08:35,000 --> 00:08:37,000
+Now we have antivirus user training.
+
+145
+00:08:37,000 --> 00:08:38,000
+Now what is it going to be.
+
+146
+00:08:38,000 --> 00:08:42,000
+Well by putting an antivirus doesn't change the value of the data does it.
+
+147
+00:08:42,000 --> 00:08:45,000
+It's still a million bucks if you get infected.
+
+148
+00:08:45,000 --> 00:08:50,000
+Even if you have antivirus and you get infected and it bypasses your antivirus, you're still going
+
+149
+00:08:50,000 --> 00:08:51,000
+to lose 100%.
+
+150
+00:08:52,000 --> 00:08:58,000
+So in this one, I'm going to leave the cell as 1 million because it's AV 1 million.
+
+151
+00:08:59,000 --> 00:09:02,000
+Times the single loss expectancy of 100.
+
+152
+00:09:02,000 --> 00:09:07,000
+So it's going to be there's 100% 1 million.
+
+153
+00:09:07,000 --> 00:09:09,000
+Now here's the thing.
+
+154
+00:09:09,000 --> 00:09:13,000
+By implementing all the how many infections are you going to have a year that's going to take out all
+
+155
+00:09:13,000 --> 00:09:14,000
+the data.
+
+156
+00:09:14,000 --> 00:09:19,000
+Let's say you bring that number down to, let's say, two infections a year.
+
+157
+00:09:19,000 --> 00:09:25,000
+That means that your L is equal to 1 million times two.
+
+158
+00:09:25,000 --> 00:09:29,000
+So you only losing $2 million every single year.
+
+159
+00:09:30,000 --> 00:09:34,000
+So by you implementing the safeguard, what is it worth to you?
+
+160
+00:09:35,000 --> 00:09:35,000
+Right.
+
+161
+00:09:35,000 --> 00:09:38,000
+What is what is the value the organization is getting out of this.
+
+162
+00:09:38,000 --> 00:09:39,000
+And that's this last number.
+
+163
+00:09:40,000 --> 00:09:44,000
+So the value is equal to the al before the safeguard we know is 50 million.
+
+164
+00:09:45,000 --> 00:09:48,000
+After minus the L after the safeguard.
+
+165
+00:09:48,000 --> 00:09:50,000
+So we know we're losing 2 million.
+
+166
+00:09:50,000 --> 00:09:52,000
+Even though you put in a safeguard guide, you're still losing 2 million.
+
+167
+00:09:52,000 --> 00:09:54,000
+So -2 million.
+
+168
+00:09:54,000 --> 00:09:57,000
+And then the actual cost of the safeguard is 10 million.
+
+169
+00:09:58,000 --> 00:10:01,000
+So let's do 50 minus two is 48.
+
+170
+00:10:01,000 --> 00:10:04,000
+Minus ten is 38 million.
+
+171
+00:10:05,000 --> 00:10:07,000
+This is what the organization is gaining.
+
+172
+00:10:07,000 --> 00:10:14,000
+This is like their value that they're gaining because of the antivirus protection or the malware protection.
+
+173
+00:10:14,000 --> 00:10:16,000
+You see guys, that's what you need.
+
+174
+00:10:16,000 --> 00:10:17,000
+Antivirus.
+
+175
+00:10:17,000 --> 00:10:18,000
+Okay.
+
+176
+00:10:18,000 --> 00:10:20,000
+Replay this video a couple of times.
+
+177
+00:10:20,000 --> 00:10:22,000
+Make sure you really understand these formulas.
+
+178
+00:10:22,000 --> 00:10:27,000
+Now the last thing I want to mention uh is going to be uh qualitative assessment.
+
+179
+00:10:27,000 --> 00:10:34,000
+So qualitative assessment is assessing risk based on subjective criteria such as expert opinions uh
+
+180
+00:10:34,000 --> 00:10:39,000
+scenario analysis and generally all kinds of industry best practices.
+
+181
+00:10:39,000 --> 00:10:41,000
+It'll categorize risk into high, medium or low.
+
+182
+00:10:42,000 --> 00:10:44,000
+It just it does not use numbers.
+
+183
+00:10:44,000 --> 00:10:49,000
+You see in order to do this you got to go out and you got to grab numbers, man.
+
+184
+00:10:49,000 --> 00:10:51,000
+You got to go and do all the research.
+
+185
+00:10:51,000 --> 00:10:57,000
+For example, when I told you guys that there is a 1% chance of getting an earthquake in New York City,
+
+186
+00:10:57,000 --> 00:10:58,000
+that is an actual number.
+
+187
+00:10:58,000 --> 00:11:02,000
+I had to research that for a project that was working on a while back.
+
+188
+00:11:02,000 --> 00:11:07,000
+Now, this approach is useful for understanding the general magnitude of risks.
+
+189
+00:11:07,000 --> 00:11:12,000
+So keep in mind qualitative analysis is very subjective.
+
+190
+00:11:12,000 --> 00:11:13,000
+All right.
+
+191
+00:11:13,000 --> 00:11:15,000
+It's done by people's opinion.
+
+192
+00:11:15,000 --> 00:11:18,000
+It uses rankings such as high, medium or low.
+
+193
+00:11:18,000 --> 00:11:22,000
+It's quick and it's easy to do and it doesn't require a ton of data.
+
+194
+00:11:23,000 --> 00:11:28,000
+Quantitative assessment is more objective, requires a ton of data, takes a lot of time.
+
+195
+00:11:28,000 --> 00:11:32,000
+And of course it's going to be more expensive because it does require a lot more time.
+
+196
+00:11:32,000 --> 00:11:35,000
+So keep that in mind when taking your exam.
+

21 - Risk Management/004 Risk Register OB 5.2_en.srt

@@ -0,0 +1,424 @@
+1
+00:00:00,000 --> 00:00:05,000
+When you do your risk assessment, such as your qualitative and quantitative, and you identify your
+
+2
+00:00:05,000 --> 00:00:07,000
+risks, you have to store this somewhere.
+
+3
+00:00:07,000 --> 00:00:09,000
+You have to store this in a particular document.
+
+4
+00:00:09,000 --> 00:00:11,000
+We're going to call the risk register.
+
+5
+00:00:11,000 --> 00:00:17,000
+So the risk register is basically a component of good risk management because it serves as the central
+
+6
+00:00:17,000 --> 00:00:21,000
+repository for all the risk in it.
+
+7
+00:00:21,000 --> 00:00:23,000
+Now I do have a sample of it here.
+
+8
+00:00:23,000 --> 00:00:26,000
+Every risk register can be different in every organization.
+
+9
+00:00:26,000 --> 00:00:30,000
+This is a sample that I got from a risk register template here on this website.
+
+10
+00:00:30,000 --> 00:00:33,000
+At a minimum it's going to have the identified risks.
+
+11
+00:00:33,000 --> 00:00:39,000
+The assessments on them, such as the description and the potential actions that we want to take against
+
+12
+00:00:39,000 --> 00:00:39,000
+them.
+
+13
+00:00:39,000 --> 00:00:44,000
+Notice in this risk register I know it's hard to see, but you can expand it on the you know, when
+
+14
+00:00:44,000 --> 00:00:45,000
+you see the slide, it'll be easier.
+
+15
+00:00:45,000 --> 00:00:50,000
+Uh the description notice they have an impact description, the level, how it's going to impact.
+
+16
+00:00:50,000 --> 00:00:51,000
+It's a high medium or low.
+
+17
+00:00:51,000 --> 00:00:53,000
+Um, they have a priority.
+
+18
+00:00:53,000 --> 00:00:56,000
+They also have a mitigation note like what are we going to do to reduce this risk.
+
+19
+00:00:56,000 --> 00:01:00,000
+So at a minimum, a risk register should have a description of the risk.
+
+20
+00:01:00,000 --> 00:01:03,000
+Like what exactly is the risk in the world of it.
+
+21
+00:01:04,000 --> 00:01:06,000
+We can have ransomware.
+
+22
+00:01:06,000 --> 00:01:07,000
+That's a risk.
+
+23
+00:01:07,000 --> 00:01:08,000
+What's the description of it.
+
+24
+00:01:08,000 --> 00:01:13,000
+Well ransomware can encrypt the data and then hold us hostage by making us want to pay to get the data
+
+25
+00:01:13,000 --> 00:01:14,000
+back.
+
+26
+00:01:14,000 --> 00:01:21,000
+So we want a nice detail risk register with a nice detailed description of each individual risk.
+
+27
+00:01:21,000 --> 00:01:26,000
+If you have a risk with hurricane floods, power outages describe how you know how is that going to
+
+28
+00:01:26,000 --> 00:01:28,000
+affect the actual business.
+
+29
+00:01:28,000 --> 00:01:33,000
+So describe the risks, the assets that are affected, the consequences.
+
+30
+00:01:33,000 --> 00:01:38,000
+For example, if there's a power outage at a major data center, you can see that this can bring the
+
+31
+00:01:38,000 --> 00:01:41,000
+data center down for extended periods of time, causing the organization a lot of money.
+
+32
+00:01:43,000 --> 00:01:49,000
+Another thing here you're going to want to have on your risk register is what's called your Chris or
+
+33
+00:01:49,000 --> 00:01:51,000
+your key risk indicators.
+
+34
+00:01:51,000 --> 00:01:56,000
+These are metrics you're going to use to measure and monitor the likelihood and impact of a risk.
+
+35
+00:01:56,000 --> 00:02:00,000
+They provide early warnings that a risk may be increasing or decreasing.
+
+36
+00:02:00,000 --> 00:02:05,000
+For example, in a high number of failed login this may be a cry for unauthorized access.
+
+37
+00:02:05,000 --> 00:02:07,000
+So think about this.
+
+38
+00:02:07,000 --> 00:02:15,000
+At what point do you look at and say, well, this risk is most likely to happen, right?
+
+39
+00:02:15,000 --> 00:02:16,000
+Like what's that?
+
+40
+00:02:16,000 --> 00:02:18,000
+What's that number?
+
+41
+00:02:18,000 --> 00:02:24,000
+Like, what does that look like to you when you say, well, okay, this is risk is probably going to
+
+42
+00:02:24,000 --> 00:02:24,000
+take place.
+
+43
+00:02:24,000 --> 00:02:26,000
+For example, like they're saying here.
+
+44
+00:02:26,000 --> 00:02:31,000
+Well there's going to be a high this ten failed logins.
+
+45
+00:02:31,000 --> 00:02:33,000
+Is that is that a good number for you.
+
+46
+00:02:33,000 --> 00:02:34,000
+But you see ten fail.
+
+47
+00:02:34,000 --> 00:02:35,000
+Log on from that.
+
+48
+00:02:35,000 --> 00:02:37,000
+Users did this user account is under attack.
+
+49
+00:02:37,000 --> 00:02:40,000
+The risk is starting to materialize itself.
+
+50
+00:02:41,000 --> 00:02:48,000
+So you have to come up with KPIs that can give you basically early warning signs that a risk is happening.
+
+51
+00:02:48,000 --> 00:02:57,000
+Another example, let's say a system has generated, uh, ten different error that the operating system
+
+52
+00:02:57,000 --> 00:03:00,000
+is getting corrupted or the operating system stopped responding.
+
+53
+00:03:00,000 --> 00:03:06,000
+How many of those errors do you need to see before you go in and say, okay, let's reinstall the operating
+
+54
+00:03:06,000 --> 00:03:09,000
+system before the whole thing crashes and produces a massive failure.
+
+55
+00:03:09,000 --> 00:03:11,000
+You need to come up with those numbers.
+
+56
+00:03:11,000 --> 00:03:12,000
+Every organization is different.
+
+57
+00:03:13,000 --> 00:03:15,000
+You want to assign a risk owner.
+
+58
+00:03:15,000 --> 00:03:19,000
+A risk owner is someone who's held responsible for managing and mitigating that risk.
+
+59
+00:03:19,000 --> 00:03:23,000
+So you can go through the risk register and say, well, this risk is owned by this person.
+
+60
+00:03:23,000 --> 00:03:28,000
+That way this person takes ownership of it and build a team to help secure against this risk.
+
+61
+00:03:28,000 --> 00:03:33,000
+Now there's generally someone who's going to be in a manager owner management role and has the authority
+
+62
+00:03:33,000 --> 00:03:37,000
+and knowledge to come up with the right responses now.
+
+63
+00:03:38,000 --> 00:03:42,000
+What exactly is the threshold for the level of action?
+
+64
+00:03:42,000 --> 00:03:42,000
+All right.
+
+65
+00:03:42,000 --> 00:03:47,000
+Threshold refers to the level of risk that the organization is willing to accept.
+
+66
+00:03:47,000 --> 00:03:51,000
+Risks that fall below the threshold is probably you're just going to watch it.
+
+67
+00:03:51,000 --> 00:03:52,000
+You're going to accept it.
+
+68
+00:03:52,000 --> 00:03:53,000
+You're going to monitor it.
+
+69
+00:03:53,000 --> 00:03:59,000
+Anything above it will require an activation notice will require activation of mitigation.
+
+70
+00:03:59,000 --> 00:04:02,000
+So let's say you're watching the operating system.
+
+71
+00:04:02,000 --> 00:04:03,000
+You're watching the operating.
+
+72
+00:04:03,000 --> 00:04:08,000
+You're seeing that the hard drive is getting filled very quickly because it's a backup machine.
+
+73
+00:04:09,000 --> 00:04:11,000
+What is the threshold that we increase the storage.
+
+74
+00:04:11,000 --> 00:04:13,000
+We're going to run out of storage.
+
+75
+00:04:13,000 --> 00:04:15,000
+Is it when it's 80% filled?
+
+76
+00:04:15,000 --> 00:04:16,000
+Is it when it's 90% filled.
+
+77
+00:04:16,000 --> 00:04:19,000
+That's something you have to determine.
+
+78
+00:04:19,000 --> 00:04:20,000
+So that's the risk threshold.
+
+79
+00:04:20,000 --> 00:04:21,000
+All right.
+
+80
+00:04:21,000 --> 00:04:25,000
+Don't forget guys make sure you understand what exactly is a risk register.
+
+81
+00:04:25,000 --> 00:04:29,000
+A risk register is a document that you're going to put all your risk on.
+
+82
+00:04:29,000 --> 00:04:30,000
+You're going to describe them.
+
+83
+00:04:30,000 --> 00:04:34,000
+You're going to have risk owners risk thresholds you're going to put on there.
+
+84
+00:04:35,000 --> 00:04:36,000
+And now risk indicators.
+
+85
+00:04:36,000 --> 00:04:40,000
+Also you're going to have if you're wondering, hey Andrew, what's in between that indicator and the
+
+86
+00:04:40,000 --> 00:04:41,000
+threshold?
+
+87
+00:04:41,000 --> 00:04:45,000
+Well, remember indicator is the early warning sign that the risk is happening.
+
+88
+00:04:45,000 --> 00:04:46,000
+The risk threshold is okay.
+
+89
+00:04:46,000 --> 00:04:47,000
+It crossed this.
+
+90
+00:04:47,000 --> 00:04:48,000
+It needs to be fixed.
+
+91
+00:04:48,000 --> 00:04:50,000
+Remember indicators are early warning signs.
+
+92
+00:04:50,000 --> 00:04:53,000
+For example, if you go back to the server backup.
+
+93
+00:04:53,000 --> 00:05:00,000
+Well, if the server backups start to exceed, let's say the maximum, you're willing to lose 80%.
+
+94
+00:05:00,000 --> 00:05:06,000
+If the backup drives are more than 80% filled, you've got to up the storage before you run out of space
+
+95
+00:05:06,000 --> 00:05:08,000
+and then the risk of no backup.
+
+96
+00:05:08,000 --> 00:05:12,000
+So the risk indicators like 70% okay, it's an early warning sign.
+
+97
+00:05:12,000 --> 00:05:12,000
+Okay.
+
+98
+00:05:12,000 --> 00:05:14,000
+This risk is probably going to happen.
+
+99
+00:05:14,000 --> 00:05:16,000
+So you start looking at it looking at it.
+
+100
+00:05:16,000 --> 00:05:19,000
+And then now you have the threshold okay.
+
+101
+00:05:19,000 --> 00:05:20,000
+Now we crossed with 81%.
+
+102
+00:05:20,000 --> 00:05:21,000
+Boom.
+
+103
+00:05:21,000 --> 00:05:25,000
+Implement the mitigation strategy of up in the drive space.
+
+104
+00:05:25,000 --> 00:05:25,000
+All right.
+
+105
+00:05:25,000 --> 00:05:26,000
+Make sure you know these terms.
+
+106
+00:05:26,000 --> 00:05:29,000
+More than likely you'll see some of them on your test.
+

21 - Risk Management/005 Risk Appetite OB 5.2_en.srt

@@ -0,0 +1,324 @@
+1
+00:00:00,000 --> 00:00:04,000
+In order to do something in life, you have to be willing to take risks.
+
+2
+00:00:04,000 --> 00:00:11,000
+You see, every thing that we do in life, every action that we take in life has risks.
+
+3
+00:00:11,000 --> 00:00:14,000
+There is a risk of me standing here.
+
+4
+00:00:14,000 --> 00:00:17,000
+I mean, the ceiling can fall on top of me, the desk can fall over.
+
+5
+00:00:17,000 --> 00:00:19,000
+There's all kinds of risks that can happen.
+
+6
+00:00:19,000 --> 00:00:20,000
+Now.
+
+7
+00:00:20,000 --> 00:00:25,000
+I have to be willing to take a certain number of risks in order to do a particular task.
+
+8
+00:00:25,000 --> 00:00:30,000
+For example, if you go out and you drive to go to the supermarket, one of the most dangerous things
+
+9
+00:00:30,000 --> 00:00:32,000
+a human can ever do is drive.
+
+10
+00:00:32,000 --> 00:00:35,000
+You have to be willing to take those risks.
+
+11
+00:00:35,000 --> 00:00:39,000
+The risk of getting into a car accident or the risk of death in a car accident.
+
+12
+00:00:39,000 --> 00:00:42,000
+Now, this brings me to a particular terme that we want to be familiar with.
+
+13
+00:00:42,000 --> 00:00:44,000
+It's called the risk appetite.
+
+14
+00:00:44,000 --> 00:00:50,000
+This refers to the risk that an organization is prepared to pursue, retain, or take in its operation.
+
+15
+00:00:50,000 --> 00:00:55,000
+So what kind of risk is the organization willing to take?
+
+16
+00:00:55,000 --> 00:00:55,000
+Now?
+
+17
+00:00:56,000 --> 00:01:01,000
+The organization is going to have to know the risk that they're willing to take in order to do, to
+
+18
+00:01:01,000 --> 00:01:04,000
+build a particular product or a particular service.
+
+19
+00:01:04,000 --> 00:01:10,000
+In fact, in businesses today, it's all about risk because they're willing to spend money to create
+
+20
+00:01:10,000 --> 00:01:15,000
+this product or service, and they don't know if it's going to be sold or not, reflects the organization
+
+21
+00:01:15,000 --> 00:01:17,000
+attitude towards its risk.
+
+22
+00:01:17,000 --> 00:01:21,000
+Now, what's going to influence the risk appetite?
+
+23
+00:01:21,000 --> 00:01:26,000
+So the risk appetite is going to be influenced by its culture, the goals, market conditions and so
+
+24
+00:01:26,000 --> 00:01:26,000
+on.
+
+25
+00:01:26,000 --> 00:01:29,000
+Another time you might see is the risk tolerance.
+
+26
+00:01:29,000 --> 00:01:34,000
+This is the amount of the risk that the organization is willing to take or to withstand.
+
+27
+00:01:34,000 --> 00:01:35,000
+Let me explain.
+
+28
+00:01:35,000 --> 00:01:41,000
+So the risk appetite, well, I'm willing to to take this much.
+
+29
+00:01:41,000 --> 00:01:42,000
+You know, I'm willing to take this risk.
+
+30
+00:01:42,000 --> 00:01:44,000
+But how much of that risk are you willing to take?
+
+31
+00:01:44,000 --> 00:01:47,000
+At what point does that risk becomes too much?
+
+32
+00:01:47,000 --> 00:01:52,000
+You know, one of the best examples of appetite versus tolerance is like speed limit.
+
+33
+00:01:53,000 --> 00:01:59,000
+So a highway can have a speed limit of 60 miles an hour, or let's say 65 miles an hour.
+
+34
+00:01:59,000 --> 00:02:01,000
+So that's the risk.
+
+35
+00:02:01,000 --> 00:02:03,000
+You know, that's the maximum speed.
+
+36
+00:02:03,000 --> 00:02:05,000
+So what is the risk of driving on a highway?
+
+37
+00:02:05,000 --> 00:02:10,000
+Well, you know, crashes are dying of course getting injured and so on.
+
+38
+00:02:10,000 --> 00:02:13,000
+So those are all the risks that's there.
+
+39
+00:02:13,000 --> 00:02:15,000
+Now the tolerance.
+
+40
+00:02:15,000 --> 00:02:15,000
+Well.
+
+41
+00:02:16,000 --> 00:02:19,000
+At what point are you not going to drive that highway?
+
+42
+00:02:19,000 --> 00:02:20,000
+At what point are you going to get pulled over?
+
+43
+00:02:20,000 --> 00:02:25,000
+So, for example, the police on the highway is going to say, well, if they drive at 65, they're
+
+44
+00:02:25,000 --> 00:02:26,000
+okay.
+
+45
+00:02:26,000 --> 00:02:27,000
+If they go up to 70, they're fine.
+
+46
+00:02:27,000 --> 00:02:30,000
+But after 70, we're not willing to take that anymore.
+
+47
+00:02:30,000 --> 00:02:33,000
+Anybody that goes over 70 miles, we're going to stop them.
+
+48
+00:02:33,000 --> 00:02:38,000
+So the amount of risk, like how much of that risk are you actually willing to take?
+
+49
+00:02:38,000 --> 00:02:39,000
+That's the risk tolerance.
+
+50
+00:02:39,000 --> 00:02:41,000
+So you have to know that also.
+
+51
+00:02:41,000 --> 00:02:47,000
+Now when it comes to risk appetite there is expansionary risk appetite.
+
+52
+00:02:47,000 --> 00:02:54,000
+In other words, your risk appetite may be expanding over time to accommodate more risk or higher higher
+
+53
+00:02:54,000 --> 00:02:56,000
+levels of risk in pursuit of a greater reward.
+
+54
+00:02:56,000 --> 00:03:01,000
+Generally, the more risk, the bigger the reward in the world of business, right?
+
+55
+00:03:01,000 --> 00:03:07,000
+Generally, people can pursue things that can give them a great payback, but there's a high risk of
+
+56
+00:03:07,000 --> 00:03:07,000
+failure.
+
+57
+00:03:07,000 --> 00:03:11,000
+For example, purchasing a stock in a brand new company that just started.
+
+58
+00:03:11,000 --> 00:03:13,000
+Yeah, the stock price is cheap.
+
+59
+00:03:13,000 --> 00:03:18,000
+And there's a if the company does well and make a ton of money, think of like investing in Tesla when
+
+60
+00:03:18,000 --> 00:03:19,000
+it first started.
+
+61
+00:03:19,000 --> 00:03:20,000
+So.
+
+62
+00:03:21,000 --> 00:03:27,000
+Companies that does this are often in growth phases, seeking competitive advantage and willing to invest
+
+63
+00:03:27,000 --> 00:03:29,000
+in the opportunity of a higher risk.
+
+64
+00:03:29,000 --> 00:03:31,000
+But remember, these things will carry higher risks.
+
+65
+00:03:31,000 --> 00:03:37,000
+Now, some companies are more conservative towards it and implies a preference for lower risk and focus
+
+66
+00:03:37,000 --> 00:03:39,000
+on more stability.
+
+67
+00:03:39,000 --> 00:03:43,000
+Organizations with a conservative appetite, uh, prioritize.
+
+68
+00:03:43,000 --> 00:03:46,000
+Protect an asset and minimizing potential losses.
+
+69
+00:03:46,000 --> 00:03:50,000
+And then the other one here we have is a neutral risk appetite.
+
+70
+00:03:50,000 --> 00:03:51,000
+They just go with the market.
+
+71
+00:03:51,000 --> 00:03:54,000
+Strikes a balance between the two of them.
+
+72
+00:03:54,000 --> 00:03:59,000
+Organizations with a neutral are willing to accept some level of risk for a reasonable return, but
+
+73
+00:03:59,000 --> 00:04:01,000
+not inclined to pursue high level risks.
+
+74
+00:04:01,000 --> 00:04:04,000
+So if your company is right in the middle, in other words, it's not too conservative.
+
+75
+00:04:04,000 --> 00:04:11,000
+It doesn't take a lot of risk versus your your company takes a ton of risk to get higher rewards.
+
+76
+00:04:11,000 --> 00:04:15,000
+Most of us are probably going to be somewhere here.
+
+77
+00:04:15,000 --> 00:04:16,000
+All right.
+
+78
+00:04:16,000 --> 00:04:21,000
+Just remember, uh, when it comes to risk management, remember what risk appetite is.
+
+79
+00:04:21,000 --> 00:04:25,000
+It's all the risk that you're willing to take on in order to pursue a particular goal.
+
+80
+00:04:25,000 --> 00:04:29,000
+And then how much of that risk can you actually withstand is your risk tolerance?
+
+81
+00:04:29,000 --> 00:04:32,000
+Keep that in mind if you see these terms on your exam.
+

21 - Risk Management/006 Risk Response OB 5.2_en.srt

@@ -0,0 +1,424 @@
+1
+00:00:00,000 --> 00:00:05,000
+When you have identified a risk and know how that risk is going to impact your organization, the next
+
+2
+00:00:05,000 --> 00:00:10,000
+step is going to do is to come up with potential ways to respond to that risk.
+
+3
+00:00:10,000 --> 00:00:15,000
+In this video, I want to go through some of the different ways that organizations can respond to resources.
+
+4
+00:00:15,000 --> 00:00:22,000
+In particularly it's known are the responses are avoidance, mitigate, transfer and accept.
+
+5
+00:00:22,000 --> 00:00:24,000
+So let's go into these here.
+
+6
+00:00:24,000 --> 00:00:28,000
+So the first one up that I want to talk about is going to be risk avoidance.
+
+7
+00:00:28,000 --> 00:00:37,000
+Now risk avoidance involves changing plans or procedures to eliminate the risk or to remove the organization's
+
+8
+00:00:37,000 --> 00:00:38,000
+exposure to it.
+
+9
+00:00:38,000 --> 00:00:40,000
+This means not this.
+
+10
+00:00:40,000 --> 00:00:44,000
+This might mean not implementing a certain system or technology.
+
+11
+00:00:44,000 --> 00:00:51,000
+So avoidance is the process of eliminating completely removing the risk.
+
+12
+00:00:51,000 --> 00:00:52,000
+Let me give you an example.
+
+13
+00:00:53,000 --> 00:00:58,000
+Let's say there is a risk that virus A can infect a windows server.
+
+14
+00:00:58,000 --> 00:01:00,000
+How do you avoid this risk.
+
+15
+00:01:00,000 --> 00:01:02,000
+Well don't use windows right?
+
+16
+00:01:02,000 --> 00:01:03,000
+Use a Linux server.
+
+17
+00:01:03,000 --> 00:01:05,000
+Virus A only infects windows.
+
+18
+00:01:05,000 --> 00:01:11,000
+So you have effectively avoided virus a risk to your organization.
+
+19
+00:01:11,000 --> 00:01:17,000
+So risk avoidance is some kind of action that you're going to take that that results in the risk completely
+
+20
+00:01:17,000 --> 00:01:19,000
+being gone 100% gone.
+
+21
+00:01:20,000 --> 00:01:25,000
+Now the other one that confuses folks with avoidance is mitigation.
+
+22
+00:01:25,000 --> 00:01:31,000
+Now, a lot of times when people say mitigation, they they mean all four of the different responses.
+
+23
+00:01:31,000 --> 00:01:33,000
+But mitigation is a very particular thing.
+
+24
+00:01:33,000 --> 00:01:37,000
+It refers to taking steps to reduce the likelihood or impact of a risk.
+
+25
+00:01:37,000 --> 00:01:42,000
+This is going to be things like implementing security controls, updating your software, user training,
+
+26
+00:01:42,000 --> 00:01:46,000
+monitoring systems, even things such as implementing antivirus.
+
+27
+00:01:46,000 --> 00:01:52,000
+Remember something mitigation doesn't remove the risk 100% like it's completely gone.
+
+28
+00:01:52,000 --> 00:01:57,000
+So in the case with virus A in a windows server, what you're going to do is you're going to patch it,
+
+29
+00:01:57,000 --> 00:02:01,000
+you're going to update it, you're going to do user training, you're going to put malware detection
+
+30
+00:02:01,000 --> 00:02:02,000
+and removal software on it.
+
+31
+00:02:02,000 --> 00:02:06,000
+So the risk of getting the virus is still there.
+
+32
+00:02:06,000 --> 00:02:11,000
+It's just that its impact and or probability has been drastically reduced.
+
+33
+00:02:11,000 --> 00:02:18,000
+So remember that for your exam avoidance completely eliminates the risk versus mitigation reduces the
+
+34
+00:02:18,000 --> 00:02:19,000
+risk.
+
+35
+00:02:19,000 --> 00:02:27,000
+Risk transfer is given away to risk to a third party, shifting the impact to a third party.
+
+36
+00:02:27,000 --> 00:02:30,000
+This is generally done by purchasing insurance.
+
+37
+00:02:30,000 --> 00:02:31,000
+All right.
+
+38
+00:02:31,000 --> 00:02:37,000
+So if you buy insurance policies for example, there's a risk that a fire can bring down your entire
+
+39
+00:02:37,000 --> 00:02:38,000
+infrastructure.
+
+40
+00:02:38,000 --> 00:02:43,000
+Well in order to transfer that risk you buy fire insurance.
+
+41
+00:02:43,000 --> 00:02:47,000
+If there is a fire, then the insurance company is going to have to take care of it.
+
+42
+00:02:47,000 --> 00:02:51,000
+So this transfer is a financial risk to the insurance provider through outsourcing the risks.
+
+43
+00:02:51,000 --> 00:02:59,000
+Remember, anytime you see the word insurance, think transfer risk acceptance is when you do absolutely
+
+44
+00:02:59,000 --> 00:02:59,000
+nothing.
+
+45
+00:02:59,000 --> 00:03:04,000
+It's a decision to not take any action against a risk.
+
+46
+00:03:04,000 --> 00:03:06,000
+In other words, you're not eliminating it.
+
+47
+00:03:06,000 --> 00:03:10,000
+You're not giving it away to somebody else like an insurance company, and you're not taking steps to
+
+48
+00:03:10,000 --> 00:03:11,000
+reduce it.
+
+49
+00:03:11,000 --> 00:03:12,000
+You're just leaving it alone.
+
+50
+00:03:12,000 --> 00:03:13,000
+If it happens, it happens.
+
+51
+00:03:13,000 --> 00:03:17,000
+Now you're probably saying, well, why would you do that?
+
+52
+00:03:17,000 --> 00:03:20,000
+Well, a couple of different couple different reasons.
+
+53
+00:03:20,000 --> 00:03:25,000
+Number one, sometimes the cost of mitigating the risk is greater than the potential loss.
+
+54
+00:03:25,000 --> 00:03:33,000
+For example, let's say you bought a car for $500 and the cheapest alarm system is $2,000, the cheapest
+
+55
+00:03:33,000 --> 00:03:34,000
+one.
+
+56
+00:03:34,000 --> 00:03:38,000
+So your car is 500 and the cheapest alarm is 2000.
+
+57
+00:03:38,000 --> 00:03:40,000
+Would you buy it an alarm system?
+
+58
+00:03:40,000 --> 00:03:42,000
+Would you spend $2,000 protecting 500?
+
+59
+00:03:43,000 --> 00:03:46,000
+You'd say, you know what, if the car gets stolen, it gets stolen.
+
+60
+00:03:46,000 --> 00:03:48,000
+I'm just going to leave it alone.
+
+61
+00:03:48,000 --> 00:03:50,000
+Another time is sometimes the risk.
+
+62
+00:03:50,000 --> 00:03:52,000
+Sometimes the likelihood is way too low.
+
+63
+00:03:54,000 --> 00:03:55,000
+Earthquake in New York City.
+
+64
+00:03:55,000 --> 00:03:56,000
+I live in New York City.
+
+65
+00:03:56,000 --> 00:04:03,000
+Do I have earthquake insurance, earthquake proof housing or earthquake response plan?
+
+66
+00:04:03,000 --> 00:04:03,000
+Nope.
+
+67
+00:04:04,000 --> 00:04:05,000
+If it happens, it happens.
+
+68
+00:04:05,000 --> 00:04:07,000
+I haven't made any plan for it.
+
+69
+00:04:07,000 --> 00:04:11,000
+I don't have any insurance for it because its probability is too low for me to worry about it.
+
+70
+00:04:11,000 --> 00:04:15,000
+Now you're probably asking yourself, well, when are times we want to accept the risk?
+
+71
+00:04:15,000 --> 00:04:19,000
+Sometimes it could be an exemption or an exception.
+
+72
+00:04:19,000 --> 00:04:20,000
+So an exemption is specific.
+
+73
+00:04:20,000 --> 00:04:24,000
+Risk might be exempt from mitigation due to the nature.
+
+74
+00:04:24,000 --> 00:04:29,000
+For example, you might decide not to install antivirus on a particular machine.
+
+75
+00:04:29,000 --> 00:04:31,000
+And you can exempt that one from antivirus.
+
+76
+00:04:31,000 --> 00:04:34,000
+And the reason is because the machine will never touch the internet.
+
+77
+00:04:34,000 --> 00:04:38,000
+The machine is only going to be connected to a particular piece of equipment, so it's exempt from a
+
+78
+00:04:38,000 --> 00:04:40,000
+particular strategy of risk.
+
+79
+00:04:40,000 --> 00:04:44,000
+An exception is similar to an exemption.
+
+80
+00:04:45,000 --> 00:04:47,000
+Generally it's going to be a temporary thing.
+
+81
+00:04:47,000 --> 00:04:52,000
+Now the other thing that we want to know is risk exploitation.
+
+82
+00:04:52,000 --> 00:04:54,000
+Not all risk are going to be negative.
+
+83
+00:04:54,000 --> 00:04:56,000
+In fact there is a thing like positive risk.
+
+84
+00:04:56,000 --> 00:04:59,000
+So sometimes you want the risk to happen.
+
+85
+00:04:59,000 --> 00:05:01,000
+See negative risk increases cost.
+
+86
+00:05:01,000 --> 00:05:03,000
+Reduces functionality.
+
+87
+00:05:04,000 --> 00:05:05,000
+Brings your system down.
+
+88
+00:05:05,000 --> 00:05:11,000
+Sometimes you want to take advantage of potential positive impact of certain risks that could produce
+
+89
+00:05:11,000 --> 00:05:13,000
+a positive result.
+
+90
+00:05:13,000 --> 00:05:18,000
+So while this is less common in cybersecurity, it's common in project management, though less common
+
+91
+00:05:18,000 --> 00:05:19,000
+in cybersecurity.
+
+92
+00:05:19,000 --> 00:05:26,000
+Sometimes certain technological or certain technology can increase functionality if happens.
+
+93
+00:05:26,000 --> 00:05:30,000
+Now, when it comes to all of this, you're going to want to make sure you do a good risk reporting.
+
+94
+00:05:31,000 --> 00:05:37,000
+This involves understanding the process of communicating information about risks, their identified
+
+95
+00:05:37,000 --> 00:05:39,000
+risks, their analysis and mitigation to stakeholders.
+
+96
+00:05:39,000 --> 00:05:47,000
+Stakeholders within the organisation should know what you plan to do about certain risks, that potential
+
+97
+00:05:47,000 --> 00:05:47,000
+risk register.
+
+98
+00:05:47,000 --> 00:05:49,000
+This is going to be a critical element.
+
+99
+00:05:49,000 --> 00:05:53,000
+It ensures transparency and ongoing management of risk management.
+
+100
+00:05:53,000 --> 00:05:54,000
+Okay.
+
+101
+00:05:54,000 --> 00:05:57,000
+Be familiar with the four different ways of managing risk.
+
+102
+00:05:57,000 --> 00:06:02,000
+Remember something avoidance is an action taken to completely eliminate the risk.
+
+103
+00:06:03,000 --> 00:06:06,000
+Mitigation is an action taken to reduce the risk.
+
+104
+00:06:06,000 --> 00:06:13,000
+Transfer is to give away the risk to a third party by an insurance, and acceptance means to do absolutely
+
+105
+00:06:13,000 --> 00:06:14,000
+nothing about the risk.
+
+106
+00:06:14,000 --> 00:06:16,000
+Remember those four strategies for your exam?
+

21 - Risk Management/007 Business Impact Assessment OB 5.2_en.srt

@@ -0,0 +1,352 @@
+1
+00:00:00,000 --> 00:00:06,000
+When it comes to a disaster, every business has to understand how certain disasters can affect their
+
+2
+00:00:06,000 --> 00:00:07,000
+business.
+
+3
+00:00:07,000 --> 00:00:13,000
+This particular exercise of how you go through how different disasters can affect your business is called
+
+4
+00:00:13,000 --> 00:00:17,000
+a business impact analysis, and it basically is.
+
+5
+00:00:17,000 --> 00:00:24,000
+When it's done in business continuity, it helps identify and evaluate the potential effects of interruptions
+
+6
+00:00:24,000 --> 00:00:27,000
+to critical business operations.
+
+7
+00:00:27,000 --> 00:00:32,000
+For example, let's say there's a disaster like a power outage, or let's say there's a disaster of
+
+8
+00:00:33,000 --> 00:00:36,000
+a hurricane or a DDoS attacks against your server.
+
+9
+00:00:36,000 --> 00:00:40,000
+The question is exactly how does that affect your operations?
+
+10
+00:00:40,000 --> 00:00:46,000
+So a business impact analysis looks in to how is the business going to be affected?
+
+11
+00:00:46,000 --> 00:00:48,000
+How long is it going to bring down systems.
+
+12
+00:00:48,000 --> 00:00:51,000
+How long is the data center going to be offline for example.
+
+13
+00:00:52,000 --> 00:00:59,000
+So BIA is proactive measure that aids in crafting effective business continuity and disaster recovery
+
+14
+00:00:59,000 --> 00:00:59,000
+strategies.
+
+15
+00:00:59,000 --> 00:01:01,000
+Now remember this.
+
+16
+00:01:01,000 --> 00:01:06,000
+The BIA shows how a potential disaster is going to impact a business.
+
+17
+00:01:06,000 --> 00:01:09,000
+Now there are some terms that we want to review.
+
+18
+00:01:11,000 --> 00:01:15,000
+The first thing we want to talk are terms that's going to deal with what's called recovery time.
+
+19
+00:01:15,000 --> 00:01:18,000
+I have three terms here that you need to know for your exam.
+
+20
+00:01:18,000 --> 00:01:21,000
+The first one is called a maximum tolerable downtime.
+
+21
+00:01:21,000 --> 00:01:28,000
+This defines the amount of time a business function can be inoperable without causing keyword, without
+
+22
+00:01:28,000 --> 00:01:31,000
+causing irreparable harm to the business.
+
+23
+00:01:31,000 --> 00:01:34,000
+This is known sometimes as the maximum tolerable outage.
+
+24
+00:01:34,000 --> 00:01:36,000
+Now take for example.
+
+25
+00:01:36,000 --> 00:01:41,000
+Let's say you're running a website and hackers are against you and they want to bring down your website.
+
+26
+00:01:42,000 --> 00:01:50,000
+Well, if your website does go down, how long can it go down before you start to have harm done to
+
+27
+00:01:50,000 --> 00:01:53,000
+your business that you can never recover from?
+
+28
+00:01:53,000 --> 00:01:53,000
+Right.
+
+29
+00:01:53,000 --> 00:02:01,000
+So let's say if your website goes down for up to an hour, anything that you lose, you can always recover
+
+30
+00:02:01,000 --> 00:02:02,000
+the sales.
+
+31
+00:02:02,000 --> 00:02:05,000
+But anything after an hour, let's say you're an e-commerce site.
+
+32
+00:02:05,000 --> 00:02:07,000
+Yeah, that means those sales are gone forever.
+
+33
+00:02:07,000 --> 00:02:11,000
+That's harm that you'll never be able to get back, or those sales.
+
+34
+00:02:11,000 --> 00:02:12,000
+You'll never be able to make that money back.
+
+35
+00:02:13,000 --> 00:02:18,000
+So your maximum tolerable downtime for that website is one hour.
+
+36
+00:02:18,000 --> 00:02:23,000
+The question is, if your website does go down, how long will it take to fix it?
+
+37
+00:02:23,000 --> 00:02:25,000
+That's called the recovery time objectives.
+
+38
+00:02:25,000 --> 00:02:29,000
+It's the amount of time to recover a function in the event of a disaster.
+
+39
+00:02:29,000 --> 00:02:35,000
+So let's say it takes 30 minutes to recover your website up to 45 minutes.
+
+40
+00:02:35,000 --> 00:02:36,000
+Well, you're doing great.
+
+41
+00:02:36,000 --> 00:02:42,000
+In fact, the whole point of disaster recovery is to keep your toes less than your mtdz if your maximum
+
+42
+00:02:42,000 --> 00:02:43,000
+is one hour.
+
+43
+00:02:44,000 --> 00:02:46,000
+And you could bring it back up in war in 30 minutes.
+
+44
+00:02:46,000 --> 00:02:47,000
+Great.
+
+45
+00:02:47,000 --> 00:02:51,000
+You'll never suffer what's called irreparable harm.
+
+46
+00:02:51,000 --> 00:02:54,000
+In other words, you'll never suffer harm that you can't recover from.
+
+47
+00:02:55,000 --> 00:02:57,000
+Another time you want to know is what we call a recovery point.
+
+48
+00:02:57,000 --> 00:02:58,000
+Objectives.
+
+49
+00:02:58,000 --> 00:03:04,000
+You got to listen to this one defines the point in time before data loss during the outage will leave
+
+50
+00:03:04,000 --> 00:03:05,000
+the business function unrecoverable.
+
+51
+00:03:05,000 --> 00:03:07,000
+At what point?
+
+52
+00:03:07,000 --> 00:03:08,000
+Point is a key word?
+
+53
+00:03:08,000 --> 00:03:10,000
+At what point do we lose so much data?
+
+54
+00:03:10,000 --> 00:03:15,000
+Like how much data are we willing to lose before we fix this thing?
+
+55
+00:03:15,000 --> 00:03:18,000
+So this this deals with data loss.
+
+56
+00:03:18,000 --> 00:03:26,000
+Now when it comes to other terms there, when you look at when system fails, every system fails, every
+
+57
+00:03:26,000 --> 00:03:31,000
+router fails, every single server fails, every switch fails, every component will fail.
+
+58
+00:03:31,000 --> 00:03:35,000
+There's a couple of terms we need to know with regard to with regard to failure time.
+
+59
+00:03:35,000 --> 00:03:42,000
+The first thing is mean time to repair is the average time taken to repair a failed component and return
+
+60
+00:03:42,000 --> 00:03:44,000
+it back to operational status.
+
+61
+00:03:44,000 --> 00:03:47,000
+The other one is mean time between failure.
+
+62
+00:03:47,000 --> 00:03:53,000
+It's a measure of reliability and stability, indicating the average time between failure of a system.
+
+63
+00:03:53,000 --> 00:03:54,000
+Let me give you a couple of examples.
+
+64
+00:03:55,000 --> 00:03:59,000
+So let's say my sonicwall once again.
+
+65
+00:04:01,000 --> 00:04:07,000
+Now when this thing fails, let's say it's common for the for the memory chip to fail.
+
+66
+00:04:07,000 --> 00:04:10,000
+If the memory chips fail, how long will it take to repair it?
+
+67
+00:04:10,000 --> 00:04:15,000
+Well, it takes about two hours to take it out, reprogram it, reflash it, put the memory chip back
+
+68
+00:04:15,000 --> 00:04:15,000
+in.
+
+69
+00:04:15,000 --> 00:04:20,000
+So the mean time to repair for this device is two hours.
+
+70
+00:04:20,000 --> 00:04:23,000
+Now, how often does this device fail?
+
+71
+00:04:23,000 --> 00:04:27,000
+Let's say in a normal work environment, it fails every two years.
+
+72
+00:04:27,000 --> 00:04:33,000
+So the mean time between failure would be two years and the mean time to repair would be two hours.
+
+73
+00:04:33,000 --> 00:04:34,000
+All right.
+
+74
+00:04:34,000 --> 00:04:41,000
+So between the failures, how long versus how long does it take to fix it.
+
+75
+00:04:41,000 --> 00:04:42,000
+All right.
+
+76
+00:04:42,000 --> 00:04:45,000
+These were some important terms you want to be familiar with for your exam.
+
+77
+00:04:45,000 --> 00:04:48,000
+They're really famous and asking you these kinds of terms.
+
+78
+00:04:48,000 --> 00:04:53,000
+Just remember that a business impact analysis is about seeing how different disasters can affect your
+
+79
+00:04:53,000 --> 00:04:54,000
+business.
+
+80
+00:04:54,000 --> 00:05:01,000
+How long will a certain disaster take out your business for maximum tolerable outage or maximum tolerable
+
+81
+00:05:01,000 --> 00:05:02,000
+downtime?
+
+82
+00:05:02,000 --> 00:05:07,000
+MTD is how long your business can go down from a particular disaster.
+
+83
+00:05:07,000 --> 00:05:12,000
+How long will it or could it stay down before irreparable harm?
+
+84
+00:05:12,000 --> 00:05:15,000
+Now remember, you don't want to stay down.
+
+85
+00:05:15,000 --> 00:05:17,000
+You want to be able to repair it then.
+
+86
+00:05:17,000 --> 00:05:20,000
+So you want to make sure that.
+
+87
+00:05:20,000 --> 00:05:28,000
+Your RPOs RTO recovery time objective, which is how fast you can fix things, is less than your MTD.
+
+88
+00:05:28,000 --> 00:05:30,000
+Remember those terms for your tests.
+

21 - Risk Management/008 Quick Quiz.html

@@ -0,0 +1,479 @@
+<!DOCTYPE html>
+<html lang="en">
+    <head>
+        <meta charset="UTF-8" />
+        <meta http-equiv="X-UA-Compatible" content="IE=edge" />
+        <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+        <title>Quiz</title>
+        <style>
+            * {
+                font-family: system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Oxygen, Ubuntu, Cantarell,
+                    "Open Sans", "Helvetica Neue", sans-serif;
+                margin: 0;
+                padding: 0;
+                box-sizing: border-box;
+                font-size: 16px;
+            }
+
+            main {
+                padding-top: 48px;
+            }
+
+            :root {
+                --large-device-width: 850px;
+                --primary-color: #0f172a;
+                --secondary-color: #020617;
+                --primary-text-color: #c7d1dd;
+                --secondary-text-color: #061602;
+                --success-background: hsl(159, 82%, 24%);
+                --success-foreground: hsl(164, 86%, 16%);
+                --success: hsl(160, 84%, 39%);
+                --danger: #ef4444;
+                --warning: #f59e0b;
+                --info-background: hsl(218, 81%, 8%);
+                --info-foreground: hsl(217, 91%, 85%);
+                --border-color: #d1d7dc;
+                --check-box-size: 20px;
+                /* control the size */
+                --check-box-color: var(--info-foreground);
+                /* the active color */
+            }
+
+            body {
+                position: relative;
+                background-color: #020617;
+                color: var(--primary-text-color);
+            }
+
+            #score-stats-container {
+                position: fixed;
+                z-index: 10;
+                top: 0;
+                height: 40px;
+                width: 100%;
+                background-color: var(--info-background);
+
+                padding: 0px 16px;
+                color: var(--info-foreground);
+                font-weight: 600;
+                display: flex;
+                align-items: center;
+                justify-content: space-between;
+            }
+
+            #quiz-container {
+                border-radius: 8px;
+                display: flex;
+                gap: 16px;
+                flex-direction: column;
+            }
+
+            input[type="radio"] {
+                height: var(--check-box-size);
+                aspect-ratio: 1;
+                border: calc(var(--check-box-size) / 8) solid #939393;
+                padding: calc(var(--check-box-size) / 8);
+                background: radial-gradient(farthest-side, var(--check-box-color) 94%, #0000) 50%/0 0 no-repeat
+                    content-box;
+                border-radius: 50%;
+                outline-offset: calc(var(--check-box-size) / 10);
+                -webkit-appearance: none;
+                -moz-appearance: none;
+                appearance: none;
+                cursor: pointer;
+                font-size: inherit;
+                transition: 0.3s;
+            }
+
+            input[type="radio"]:checked {
+                border-color: var(--check-box-color);
+                background-size: 100% 100%;
+            }
+
+            input[type="radio"]:disabled {
+                background: linear-gradient(#939393 0 0) 50%/100% 20% no-repeat content-box;
+                opacity: 0.5;
+                cursor: not-allowed;
+            }
+
+            label {
+                display: inline-flex;
+                align-items: center;
+                gap: 10px;
+                cursor: pointer;
+                padding: 4px 6px;
+                border-radius: 4px;
+            }
+
+            @media (max-width: 767px) {
+                input[type="radio"],
+                label {
+                    cursor: default;
+                }
+
+                #quiz-container {
+                    margin-left: 8px;
+                    margin-right: 8px;
+                }
+            }
+
+            /* PC (Desktop devices) */
+            @media (min-width: 768px) {
+                body {
+                    display: flex;
+                    justify-content: center;
+                }
+
+                main {
+                    max-width: var(--large-device-width);
+                }
+
+                #score-stats-container {
+                    max-width: var(--large-device-width);
+                }
+
+                dialog {
+                    max-width: var(--large-device-width);
+                }
+            }
+
+            @media print {
+                input[type="radio"] {
+                    background: none !important;
+                    border-color: #939393 !important;
+                }
+
+                input[type="radio"]:checked {
+                    border-color: #939393 !important;
+                }
+            }
+
+            .question-lable {
+                display: flex;
+                align-items: center;
+                gap: 8px;
+            }
+
+            button {
+                -webkit-tap-highlight-color: transparent;
+                -webkit-touch-callout: none;
+                -webkit-user-select: none;
+                user-select: none;
+                outline: none;
+                position: relative;
+                overflow: hidden;
+                cursor: pointer;
+            }
+
+            .button {
+                background-color: var(--success-background);
+                border: none;
+                color: #f4f5f7;
+                opacity: 0.8;
+                font-size: 18px;
+                flex-grow: 1;
+                padding: 8px 16px;
+                border-radius: 8px;
+            }
+
+            .button:hover {
+                opacity: 1;
+            }
+
+            .explanation-btn {
+                border: none;
+                color: var(--success);
+                background-color: transparent;
+            }
+
+            #submit-button:active::after {
+                background-color: #ef4444;
+            }
+
+            .single-question-container {
+                background-color: var(--primary-color);
+                display: flex;
+                flex-direction: column;
+                gap: 8px;
+                padding: 16px;
+                border-radius: 8px;
+            }
+
+            #modal-content {
+                padding: 16px;
+                line-height: 24px;
+            }
+
+            dialog::backdrop {
+                background: rgba(0, 0, 0, 0.5);
+            }
+
+            dialog {
+                position: fixed;
+                border: 1px solid var(--border-color);
+                background-color: var(--primary-color);
+                color: rgb(240, 241, 248);
+                padding: 16px;
+                border-radius: 8px;
+                width: 80vw;
+                max-height: 80vh;
+                overflow: auto;
+                top: 50%;
+                left: 50%;
+                -webkit-transform: translateX(-50%) translateY(-50%);
+                -moz-transform: translateX(-50%) translateY(-50%);
+                -ms-transform: translateX(-50%) translateY(-50%);
+                transform: translateX(-50%) translateY(-50%);
+            }
+
+            #close-modal-btn {
+                position: absolute;
+                top: 4px;
+                right: 4px;
+                padding: 2px 8px;
+                border-radius: 2px;
+                border: none;
+                background-color: var(--danger);
+            }
+
+            .correct-answer label {
+                border: 2px solid var(--success);
+                width: 100%;
+            }
+
+            .incorrect-answer label {
+                border: 2px solid var(--danger);
+                width: 100%;
+            }
+
+            .options-container {
+                display: flex;
+                flex-direction: column;
+                gap: 4px;
+            }
+
+            #quiz-meta-container {
+                border-radius: 8px;
+                background-color: var(--primary-color);
+                margin-bottom: 12px;
+                padding: 8px;
+            }
+
+            #quiz-title {
+                text-align: center;
+                font-size: 24px;
+                margin-bottom: 8px;
+            }
+
+            #quiz-description {
+                line-height: 1.5;
+                padding: 2px 6px;
+            }
+        </style>
+    </head>
+
+    <body onload="main()">
+        <main>
+            <section id="quiz-meta-container">
+                <h1 id="quiz-title"></h1>
+                <p id="quiz-description"></p>
+            </section>
+            <section id="score-stats-container">
+                <div id="score-card">
+                    Score: <span id="current-score">999</span> of
+                    <span id="pass-percent">999%</span>
+                </div>
+                <div>Correct: <span id="correct-answers">999</span></div>
+                <div>Incorrect: <span id="wrong-answers">999</span></div>
+            </section>
+
+            <section id="quiz-container"></section>
+
+            <dialog id="modal" class="modal-container">
+                <div id="modal-content">
+                    <p id="modal-text"></p>
+                </div>
+            </dialog>
+        </main>
+
+        <script>
+            const quizData = {"quiz_id": 6180184, "quiz_description": null, "quiz_title": "Quick Quiz", "pass_percent": null, "questions": [{"_class": "assessment", "id": 74731596, "assessment_type": "multiple-choice", "prompt": {"question": "<p>A newly established e-commerce platform needs to identify potential risks to its operations. What should be their first step in the risk management process?</p>", "relatedLectureIds": "", "feedbacks": ["", "", "The first step for the e-commerce platform in the risk management process should be Risk Identification. This involves recognizing potential risks that could negatively impact their operations, such as cybersecurity threats, data breaches, or system failures. By identifying these risks upfront, the platform can better prepare and manage them. While Business Impact Analysis, setting up a Risk Register, and developing Risk Management Strategies are important, they follow after the initial identification of risks.", ""], "answers": ["<p>Conducting a Business Impact Analysis</p>", "<p>Setting up a Risk Register</p>", "<p>Performing Risk Identification</p>", "<p>Developing Risk Management Strategies</p>"]}, "correct_response": ["c"], "section": "", "question_plain": "A newly established e-commerce platform needs to identify potential risks to its operations. What should be their first step in the risk management process?", "related_lectures": []}, {"_class": "assessment", "id": 74731604, "assessment_type": "multiple-choice", "prompt": {"question": "<p>A small business is establishing a risk management process and wants to record and monitor identified risks. What tool should they prioritize setting up?</p>", "relatedLectureIds": "", "feedbacks": ["The small business should prioritize setting up a Risk Register. A Risk Register is a tool used to record identified risks, along with information such as key risk indicators, risk owners, and risk thresholds. It serves as a central repository for tracking and monitoring risks, which is essential for any risk management process. Business Impact Analysis, Risk Tolerance, and Risk Appetite are important but are separate elements of the risk management process and do not substitute for a centralized risk recording and monitoring tool.", "", "", ""], "answers": ["<p>Risk Register</p>", "<p>Business Impact Analysis Report</p>", "<p>Risk Tolerance Policy</p>", "<p>Risk Appetite Statement</p>"]}, "correct_response": ["a"], "section": "", "question_plain": "A small business is establishing a risk management process and wants to record and monitor identified risks. What tool should they prioritize setting up?", "related_lectures": []}, {"_class": "assessment", "id": 74731606, "assessment_type": "multiple-choice", "prompt": {"question": "<p>A software development firm needs to decide how to handle the risk of potential litigation due to copyright infringement. Which risk management strategy would be most appropriate?</p>", "relatedLectureIds": "", "feedbacks": ["", "", "The most appropriate risk management strategy for the software development firm in this case would be Risk Transfer. This could involve purchasing insurance to cover potential litigation costs related to copyright infringement. Risk Transfer shifts the financial burden of a risk to a third party, reducing the company's direct exposure. Risk Acceptance would involve tolerating the risk without action, Risk Avoidance would mean changing practices to eliminate the risk (which might not be feasible), and Risk Mitigation would involve reducing the risk's impact or likelihood but not transferring it", ""], "answers": ["<p>Risk Acceptance</p>", "<p>Risk Avoidance</p>", "<p>Risk Transfer</p>", "<p>Risk Mitigation</p>"]}, "correct_response": ["c"], "section": "", "question_plain": "A software development firm needs to decide how to handle the risk of potential litigation due to copyright infringement. Which risk management strategy would be most appropriate?", "related_lectures": []}, {"_class": "assessment", "id": 74731614, "assessment_type": "multiple-choice", "prompt": {"question": "<p>An online retailer is conducting a Business Impact Analysis. What are they likely focusing on to ensure business continuity?</p>", "relatedLectureIds": "", "feedbacks": ["In conducting a Business Impact Analysis, the online retailer is likely focusing on Recovery Time Objective (RTO) and Recovery Point Objective (RPO). RTO is the time within which business functions must be restored after a disruption to avoid unacceptable consequences, and RPO is the maximum age of files that must be recovered from backup storage for normal operations to resume. These objectives are crucial in planning for business continuity and disaster recovery. ARO and Probability relate to risk analysis, while Risk Tolerance and Risk Appetite pertain to how much risk the business is willi", "", "", ""], "answers": ["<p>Recovery Time Objective (RTO) and Recovery Point Objective (RPO)</p>", "<p>Annualized Rate of Occurrence (ARO) and Probability</p>", "<p>Risk Tolerance and Risk Appetite</p>", "<p>Risk Register Updates</p>"]}, "correct_response": ["a"], "section": "", "question_plain": "An online retailer is conducting a Business Impact Analysis. What are they likely focusing on to ensure business continuity?", "related_lectures": []}, {"_class": "assessment", "id": 74731624, "assessment_type": "multiple-choice", "prompt": {"question": "<p>A cloud service provider is evaluating the potential impacts of various risks on their service availability. What method of risk analysis should they use to assess the potential frequency of these risks?</p>", "relatedLectureIds": "", "feedbacks": ["", "", "The cloud service provider should use the method of assessing the Annualized Rate of Occurrence (ARO) to evaluate the potential frequency of various risks. ARO is a quantitative risk analysis tool that estimates how often a specific risk is expected to occur within a year. This assessment will help the provider understand the likelihood of different risks, which is crucial for planning mitigation strategies and ensuring reliable service availability. ", ""], "answers": ["<p>Qualitative Risk Analysis</p>", "<p>Quantitative Risk Analysis</p>", "<p>Assessing the Annualized Rate of Occurrence (ARO)</p>", "<p>Conducting a Risk Tolerance Evaluation</p>"]}, "correct_response": ["c"], "section": "", "question_plain": "A cloud service provider is evaluating the potential impacts of various risks on their service availability. What method of risk analysis should they use to assess the potential frequency of these risks?", "related_lectures": []}]};
+            let correct = new Set();
+            let incorrect = new Set();
+            let totalNumberOfQuestions = 0;
+            const quizTitle = quizData.quiz_title;
+            const quizDescription = quizData.quiz_description;
+            const questionData = quizData.questions;
+            const passPercent = quizData.pass_percent;
+            const modalTextElement = document.getElementById("modal-text");
+            const quizContainerElement = document.getElementById("quiz-container");
+
+            const dialog = document.querySelector("dialog");
+            const showButton = document.getElementById("view-explanatin");
+            const closeButton = document.getElementById("close-modal-btn");
+            const quizTitleElement = document.getElementById("quiz-title");
+            const quizDescriptionElement = document.getElementById("quiz-description");
+
+            function main() {
+                // update quiz meta data
+                document.title = quizTitle;
+                quizTitleElement.innerHTML = quizTitle;
+                quizDescriptionElement.innerHTML = quizDescription;
+
+                const passPercentElement = document.getElementById("pass-percent");
+                passPercentElement.innerHTML = passPercent + "%";
+                totalNumberOfQuestions = questionData.length;
+                // shuffle the questionData to randomize the order of the questions
+                for (let i = questionData.length - 1; i > 0; i--) {
+                    const j = Math.floor(Math.random() * (i + 1));
+                    [questionData[i], questionData[j]] = [questionData[j], questionData[i]];
+                }
+
+                let formattedQuestions = questionData.map(formatSingleQuestionData);
+                updateScore();
+                // display the formattedQuestions
+                formattedQuestions.forEach((question, idx) => {
+                    renderSingleQuestion(question, idx + 1);
+                });
+            }
+
+            /**
+             * Formats the question data from the given QuizData object.
+             *
+             * @param {Object} singleQuizData - The singleQuizData object containing prompt and correct_response.
+             * @return {Object} The formatted question object with the following properties:
+             *   - id: The ID of the question.
+             *   - question: The text of the question.
+             *   - answers: The array of answer options.
+             *   - correctAnswer: The text of the correct answer.
+             *   - explanation: The explanation of the correct answer.
+             */
+            function formatSingleQuestionData(singleQuizData = null) {
+                const { prompt, correct_response, id } = singleQuizData;
+                const questionText = prompt.question;
+                const answers = prompt.answers;
+                const correctAnswer = correct_response[0];
+                const correctAnswerText = answers[correctAnswer.toLowerCase().charCodeAt(0) - 97];
+                const questionObj = {
+                    id: id,
+                    question: questionText,
+                    answers: answers,
+                    correctAnswer: correctAnswerText,
+                    explanation: prompt?.explanation || "",
+                };
+                return questionObj;
+            }
+
+            /**
+             * Renders a single question with its options and submit button.
+             *
+             * @param {Object} singleQuestionData - The data of the question to render.
+             * @param {number} rootIndex - The index of the question in the quiz.
+             * @return {void} return nothing.
+             */
+
+            const renderSingleQuestion = (singleQuestionData = {}, rootIndex = 1) => {
+                const { id, explanation, answers, correctAnswer, question } = singleQuestionData;
+                // shuffle the answers to randomize the order of the answers
+                for (let i = answers.length - 1; i > 0; i--) {
+                    const j = Math.floor(Math.random() * (i + 1));
+                    [answers[i], answers[j]] = [answers[j], answers[i]];
+                }
+                const optionsHTML = answers
+                    .map((option, index) => {
+                        const optionId = `${id}_${index}`;
+
+                        return `
+        <div class="question-lable">
+          <input type="radio" id="${optionId}" name="${"answer"}" value="${option}" />
+          <label for="${optionId}">${option}</label>
+        </div>
+      `;
+                    })
+
+                    .join("");
+
+                const container = document.createElement("div");
+                container.innerHTML = `
+        <form data-correct-answer="${correctAnswer}" data-question-id="${id}" class="single-question-container" onsubmit="submitButtonListener(event)">
+          <div style="display: flex;justify-content: space-between;">
+            <p style="font-weight: 600">Question ${rootIndex}:</p>
+            <button type="button" onclick="renderExplanation(event)" id="${`explanation-${id}`}" data-explanation="${explanation}" class="explanation-btn">View Explanation</button>
+          </div>
+          <p style="margin-bottom: 8px;line-height: 1.5">${question}</p>
+          <div class="options-container">
+            ${optionsHTML}
+          </div>
+          <div style="display: flex; gap: 8px;">
+            <button type="submit" id="submit-button" class="button">Submit</button>
+          </div>
+        </form>
+      `;
+                quizContainerElement.appendChild(container);
+            };
+
+            /**
+             * Updates the score on the page based on the number of correct and incorrect answers.
+             *
+             * @return {void} This function does not return a value.
+             */
+            function updateScore() {
+                const currentParcentageElement = document.getElementById("current-score");
+                const correctAnswerElement = document.getElementById("correct-answers");
+                const wrongAnswerElement = document.getElementById("wrong-answers");
+                correctAnswerElement.innerHTML = correct.size;
+                wrongAnswerElement.innerHTML = incorrect.size;
+                const score = Number((correct.size / totalNumberOfQuestions) * 100).toFixed(2);
+                currentParcentageElement.innerHTML = score;
+            }
+
+            /**
+             * Handles the event when the submit button is clicked.
+             *
+             * @param {Event} e - The event object.
+             * @return {void} This function does not return anything.
+             */
+            const submitButtonListener = (e) => {
+                e.preventDefault();
+                const formData = new FormData(e.target);
+                const form = e.target;
+                const selectedOption = e.target.querySelector('input[type="radio"]:checked');
+                if (!selectedOption) {
+                    alert("Please select an answer!");
+                    return;
+                }
+
+                let isCorrect = false;
+                const { answer: userAnswer } = Object.fromEntries(formData.entries());
+                const correctAnswer = e.target.dataset.correctAnswer;
+                const questionId = e.target.dataset.questionId;
+                if (userAnswer == correctAnswer) {
+                    correct.add(questionId);
+                    incorrect.delete(questionId);
+                    isCorrect = true;
+                } else {
+                    incorrect.add(e.target.dataset.questionId);
+                    correct.delete(questionId);
+                }
+                updateScore();
+
+                const resultClass = isCorrect ? "correct-answer" : "incorrect-answer";
+
+                form.querySelectorAll(".question-lable").forEach((label) => {
+                    label.classList.remove("correct-answer", "incorrect-answer");
+                });
+                selectedOption.closest(".question-lable").classList.add(resultClass);
+            };
+
+            function renderExplanation(ev) {
+                modalTextElement.innerHTML = ev.target.dataset?.explanation || "no explanation found";
+                dialog.showModal();
+                dialog.addEventListener("click", (event) => {
+                    if (event.target === dialog) {
+                        dialog.close();
+                    }
+                });
+            }
+        </script>
+    </body>
+</html>

22 - Vendor Management/001 Vendor Assessment and Selection OB 5.3_en.srt

@@ -0,0 +1,888 @@
+1
+00:00:00,000 --> 00:00:05,000
+When it comes to working in information technology, you are going to be dealing with a lot of vendors
+
+2
+00:00:05,000 --> 00:00:07,000
+when I mean a ton of vendors, I mean a lot.
+
+3
+00:00:07,000 --> 00:00:12,000
+You see, in the world of it, we really don't make firewalls, right?
+
+4
+00:00:12,000 --> 00:00:18,000
+I've never met an organization that produces their own firewall or their own antivirus software or their
+
+5
+00:00:18,000 --> 00:00:20,000
+own operating system.
+
+6
+00:00:20,000 --> 00:00:22,000
+So we're going to be dealing with a lot of vendors.
+
+7
+00:00:22,000 --> 00:00:24,000
+For example, I have the Sonicwall student on my desk.
+
+8
+00:00:24,000 --> 00:00:29,000
+This was bought from Dell, or now Sonicwall, or I should say Dell owned Sonicwall.
+
+9
+00:00:30,000 --> 00:00:32,000
+So this is a vendor.
+
+10
+00:00:32,000 --> 00:00:35,000
+Our laptops are purchased from Lenovo, for example.
+
+11
+00:00:35,000 --> 00:00:40,000
+So in the world of technology, you're going to be dealing with a lot of vendors, whether that's a
+
+12
+00:00:40,000 --> 00:00:45,000
+third party vendor such as Dell, that you purchase your hardware from Microsoft, where you're going
+
+13
+00:00:45,000 --> 00:00:51,000
+to get your operating systems from, uh, Symantec's or Broadcom, or you're going to get your, your
+
+14
+00:00:51,000 --> 00:00:56,000
+security software from tons and tons of vendors, then you're going to have vendors coming into your
+
+15
+00:00:56,000 --> 00:01:00,000
+organization to repair some of these devices, and of course, to update your software.
+
+16
+00:01:00,000 --> 00:01:06,000
+So in this video, let's take a look at what should we be doing or what should we be looking at when
+
+17
+00:01:06,000 --> 00:01:12,000
+we are going to be assessing a particular vendor, things that we want to look for, how are we going
+
+18
+00:01:12,000 --> 00:01:13,000
+to keep them monitored?
+
+19
+00:01:13,000 --> 00:01:17,000
+And of course, in the end, part of this section will take a look at different agreements that we can
+
+20
+00:01:17,000 --> 00:01:18,000
+have with vendors.
+
+21
+00:01:18,000 --> 00:01:20,000
+Let's go through this pretty quickly.
+
+22
+00:01:20,000 --> 00:01:22,000
+So the first thing up is vendor assessment.
+
+23
+00:01:22,000 --> 00:01:25,000
+What exactly is this concept of assessing vendor.
+
+24
+00:01:26,000 --> 00:01:33,000
+Well, it's about evaluating and monitoring the security risks associated with third party providers
+
+25
+00:01:33,000 --> 00:01:34,000
+in your network.
+
+26
+00:01:34,000 --> 00:01:36,000
+You control all aspects of it.
+
+27
+00:01:36,000 --> 00:01:42,000
+But the moment you go and you introduce a third party device into your network, this device could bring
+
+28
+00:01:42,000 --> 00:01:43,000
+problems.
+
+29
+00:01:43,000 --> 00:01:48,000
+If this device is compromised and shipped to you in a compromised state, it already has malware on
+
+30
+00:01:48,000 --> 00:01:53,000
+it or some kind of monitoring legal software, and you install this into your organization.
+
+31
+00:01:53,000 --> 00:01:56,000
+You just got compromised by bringing in somebody else's software.
+
+32
+00:01:56,000 --> 00:01:58,000
+So obviously you don't want that.
+
+33
+00:01:58,000 --> 00:02:01,000
+So in this particular one, what is the security risk?
+
+34
+00:02:01,000 --> 00:02:06,000
+Well, the security risk is like I mentioned, put in compromised devices in your network.
+
+35
+00:02:06,000 --> 00:02:11,000
+It involves scrutinizing vendors cybersecurity practices, policies and compliance.
+
+36
+00:02:11,000 --> 00:02:17,000
+Listen, when I purchase software, I really don't purchase software and or hardware from small vendors.
+
+37
+00:02:17,000 --> 00:02:19,000
+I like going with the bigger vendors.
+
+38
+00:02:19,000 --> 00:02:26,000
+That's more scrutinized by all kinds of regulations they have to follow, or all kinds of different
+
+39
+00:02:26,000 --> 00:02:27,000
+financial audits that they may have.
+
+40
+00:02:29,000 --> 00:02:34,000
+Bigger vendors, in my opinion, will probably have better practices, more policies, and they're going
+
+41
+00:02:34,000 --> 00:02:36,000
+to have to be more in compliance.
+
+42
+00:02:36,000 --> 00:02:39,000
+Maybe they have things like penetration testing done on their networks.
+
+43
+00:02:39,000 --> 00:02:44,000
+Maybe they have particular audit reports, maybe they have particular way they handle data and maintain
+
+44
+00:02:44,000 --> 00:02:45,000
+privacy.
+
+45
+00:02:45,000 --> 00:02:53,000
+Now the goal here is to ensure that the vendors security posture aligns with your organization's security
+
+46
+00:02:53,000 --> 00:02:58,000
+requirements and that risk management strategies and anything that's going to be done to minimize risks
+
+47
+00:02:58,000 --> 00:03:00,000
+to our systems and data.
+
+48
+00:03:00,000 --> 00:03:08,000
+Now, security posture is this you can't have an amazing security organization with great policies,
+
+49
+00:03:08,000 --> 00:03:11,000
+but then the vendors you deal with actually don't.
+
+50
+00:03:11,000 --> 00:03:14,000
+In other words, they don't follow good security practices.
+
+51
+00:03:14,000 --> 00:03:15,000
+So what happens?
+
+52
+00:03:15,000 --> 00:03:19,000
+You end up bringing in poor security practices into your company.
+
+53
+00:03:19,000 --> 00:03:22,000
+Now there are some things here that we want to review.
+
+54
+00:03:23,000 --> 00:03:26,000
+When you are getting vendors, okay.
+
+55
+00:03:26,000 --> 00:03:32,000
+When it comes to seeing how well their security issues are managed, there is this concept of penetration
+
+56
+00:03:32,000 --> 00:03:33,000
+testing.
+
+57
+00:03:33,000 --> 00:03:38,000
+So did the vendor get a penetration test against their system?
+
+58
+00:03:38,000 --> 00:03:42,000
+Now keep in mind that you can also hire vendors to penetrate your systems.
+
+59
+00:03:42,000 --> 00:03:48,000
+When you hire a third party to get penetration testing done against you, but vendors should have a
+
+60
+00:03:48,000 --> 00:03:50,000
+pen test done against their system.
+
+61
+00:03:50,000 --> 00:03:56,000
+Think about this if this vendor is holding your private data, maybe it's a type of a cloud service
+
+62
+00:03:56,000 --> 00:03:58,000
+that they're going to be storing your information.
+
+63
+00:03:59,000 --> 00:04:03,000
+Uh, maybe it's a company that processes certain medical records because you deal in medical.
+
+64
+00:04:03,000 --> 00:04:05,000
+They're going to have your patient's information.
+
+65
+00:04:05,000 --> 00:04:10,000
+Did they have a pen test done against their system to test their security policy?
+
+66
+00:04:10,000 --> 00:04:15,000
+So this involves simulating cyber attacks against the vendor system to assess the security.
+
+67
+00:04:15,000 --> 00:04:21,000
+This particularly important for vendors handling sensitive or critical data because once again how do
+
+68
+00:04:21,000 --> 00:04:24,000
+we know if they're systems is actually secure.
+
+69
+00:04:24,000 --> 00:04:29,000
+Well, a pen test can tell us if there's any vulnerability and what those vulnerabilities are.
+
+70
+00:04:29,000 --> 00:04:35,000
+Results from this test can reveal any kind of vulnerabilities that poses a risk to that organization.
+
+71
+00:04:35,000 --> 00:04:41,000
+Another thing you may want to ask your vendors about is a right to audit clause.
+
+72
+00:04:41,000 --> 00:04:47,000
+This involves, and you're usually going to put this in your contracts that grants you the organization,
+
+73
+00:04:47,000 --> 00:04:54,000
+the right to conduct or have conducted on its behalf an audit of the vendor security practices.
+
+74
+00:04:54,000 --> 00:04:59,000
+Now, when it comes to large organizations, this is something not easy to get.
+
+75
+00:04:59,000 --> 00:05:05,000
+This is when you have something in a contract that states that you have the ability to audit them or
+
+76
+00:05:05,000 --> 00:05:10,000
+have a third party company, maybe of your choice, audit their security practices.
+
+77
+00:05:10,000 --> 00:05:11,000
+Not so much.
+
+78
+00:05:11,000 --> 00:05:14,000
+So in large organizations like large third party vendors.
+
+79
+00:05:14,000 --> 00:05:21,000
+But for example, I'm not I might not have that on a contract with Dell, but Dell generally gets a
+
+80
+00:05:21,000 --> 00:05:25,000
+lot of different third party and external audits done.
+
+81
+00:05:25,000 --> 00:05:30,000
+This can include reviewing security policies, all their different controls that they have applied.
+
+82
+00:05:30,000 --> 00:05:34,000
+And do they have any type of compliance that they have to stay with now?
+
+83
+00:05:34,000 --> 00:05:36,000
+Evidence of internal audits.
+
+84
+00:05:36,000 --> 00:05:40,000
+Every organization should be doing some kind of internal audit.
+
+85
+00:05:40,000 --> 00:05:45,000
+Internal audits is when their own auditors inside of their organization.
+
+86
+00:05:45,000 --> 00:05:51,000
+Now I spent about a year, I believe, or a little less than a year, being an internal auditor before
+
+87
+00:05:51,000 --> 00:05:52,000
+it became a pentester.
+
+88
+00:05:52,000 --> 00:06:00,000
+And basically you just reviewing the internal security policies, procedures and findings within the
+
+89
+00:06:00,000 --> 00:06:01,000
+organization.
+
+90
+00:06:01,000 --> 00:06:05,000
+For example, if there is a policy that says secure passwords, do we actually have that?
+
+91
+00:06:05,000 --> 00:06:12,000
+So internal audits is something that the company does on a regular basis with their own internal employees.
+
+92
+00:06:12,000 --> 00:06:20,000
+Does the vendor have evidence of these regular internal audits of their security processes and their
+
+93
+00:06:20,000 --> 00:06:20,000
+controls?
+
+94
+00:06:20,000 --> 00:06:23,000
+Maybe they can show you audit reports.
+
+95
+00:06:23,000 --> 00:06:28,000
+Maybe they can do a summary of different findings that they found and how they fixed it.
+
+96
+00:06:28,000 --> 00:06:32,000
+And what what was the remediation against those findings.
+
+97
+00:06:33,000 --> 00:06:39,000
+Now, a lot of times, one of the best things that I believe that we can get is an independent assessment.
+
+98
+00:06:39,000 --> 00:06:44,000
+I don't want the order the third party vendor to come and say, like, Dell is going to tell me, yeah,
+
+99
+00:06:44,000 --> 00:06:45,000
+we are super secure.
+
+100
+00:06:45,000 --> 00:06:48,000
+You telling me that is the same way?
+
+101
+00:06:48,000 --> 00:06:52,000
+Me telling you that I am the smartest man in the world, in my opinion.
+
+102
+00:06:52,000 --> 00:06:53,000
+So.
+
+103
+00:06:53,000 --> 00:06:59,000
+But if you can get a third party evaluator to evaluate you and tell me that you have good security controls,
+
+104
+00:06:59,000 --> 00:07:01,000
+that gives me a good peace of mind.
+
+105
+00:07:01,000 --> 00:07:03,000
+So that's an independent assessment.
+
+106
+00:07:03,000 --> 00:07:07,000
+It's generally done by third party and sometimes it involves a certification.
+
+107
+00:07:07,000 --> 00:07:13,000
+There's what's called ISO certification or ISO 27,000 which produces an information security management
+
+108
+00:07:13,000 --> 00:07:13,000
+system.
+
+109
+00:07:13,000 --> 00:07:15,000
+There's also what's called SoC audits.
+
+110
+00:07:15,000 --> 00:07:20,000
+These are going to be audits to test for different security controls against the CIA.
+
+111
+00:07:20,000 --> 00:07:23,000
+These provides more of an objective evaluation.
+
+112
+00:07:23,000 --> 00:07:27,000
+An objective means something that is very detailed.
+
+113
+00:07:27,000 --> 00:07:30,000
+It's not subjective like you can question it.
+
+114
+00:07:30,000 --> 00:07:35,000
+The critical for verifying that the vendor heeds the good industry practices.
+
+115
+00:07:35,000 --> 00:07:38,000
+So if you want to know, does your vendor follow good security practices?
+
+116
+00:07:38,000 --> 00:07:42,000
+A good third party independent assessment is important.
+
+117
+00:07:42,000 --> 00:07:46,000
+Another thing you're going to want to ask your vendors about is going to be what's called supply chain
+
+118
+00:07:46,000 --> 00:07:47,000
+analysis.
+
+119
+00:07:47,000 --> 00:07:48,000
+Supply chain.
+
+120
+00:07:48,000 --> 00:07:49,000
+What exactly is supply chain.
+
+121
+00:07:49,000 --> 00:07:56,000
+Well, how do we take oil out of the ground and turn it into something like this?
+
+122
+00:07:56,000 --> 00:07:56,000
+Right.
+
+123
+00:07:56,000 --> 00:08:00,000
+How do we get steel out of the ground and oil out of the ground so we can develop silicone.
+
+124
+00:08:00,000 --> 00:08:04,000
+We can develop all the parts that comes together and then ship it to me.
+
+125
+00:08:05,000 --> 00:08:11,000
+So the supply chain is all the things that it goes through, from raw materials to a finished product
+
+126
+00:08:11,000 --> 00:08:14,000
+that we use as consumers of these products.
+
+127
+00:08:14,000 --> 00:08:21,000
+Supply chain could be damaged, for example, if they're using a supplier in a part of the world that
+
+128
+00:08:21,000 --> 00:08:27,000
+is subject to floods or hurricanes and stuff like that, then the supply chain can easily be affected.
+
+129
+00:08:27,000 --> 00:08:32,000
+Does the vendor have multiple supply chains or supply routes that they can get raw materials from?
+
+130
+00:08:32,000 --> 00:08:37,000
+So examining the security of the vendor supply chain has vulnerabilities in the chain can directly impact
+
+131
+00:08:37,000 --> 00:08:39,000
+the security of the products or services.
+
+132
+00:08:39,000 --> 00:08:42,000
+For example, what if they're getting a microchips?
+
+133
+00:08:43,000 --> 00:08:50,000
+From a country that is that doesn't like the United States, that can then embed malware in those microchips
+
+134
+00:08:50,000 --> 00:08:52,000
+and then ship it to me.
+
+135
+00:08:52,000 --> 00:08:57,000
+Like, for example, what if this thing has what if this sonicwall has chips from a country that doesn't
+
+136
+00:08:57,000 --> 00:09:02,000
+like the United States, that has malware embedded to it to spy on United States companies?
+
+137
+00:09:02,000 --> 00:09:08,000
+So the analysis should assess the security practices of not only the primary vendor, but all of their
+
+138
+00:09:08,000 --> 00:09:10,000
+suppliers that they have.
+
+139
+00:09:10,000 --> 00:09:12,000
+Now, another thing you want.
+
+140
+00:09:12,000 --> 00:09:13,000
+How are you going to get this done.
+
+141
+00:09:13,000 --> 00:09:16,000
+But questionnaires you got to question the vendor.
+
+142
+00:09:16,000 --> 00:09:18,000
+This question is a critical tool.
+
+143
+00:09:18,000 --> 00:09:24,000
+You're going to gather information, question them about their practices, their policies and how how
+
+144
+00:09:24,000 --> 00:09:26,000
+are they going to stay in compliance.
+
+145
+00:09:26,000 --> 00:09:26,000
+Right.
+
+146
+00:09:26,000 --> 00:09:33,000
+So the question just literally asking them questions like what practices you follow, what kind of policies
+
+147
+00:09:33,000 --> 00:09:37,000
+you have, this is really going to assess the risks that they may bring to us.
+
+148
+00:09:38,000 --> 00:09:43,000
+Now, another thing you're going to want to talk about with them is the rules of engagement.
+
+149
+00:09:43,000 --> 00:09:46,000
+This is something that you may want to outline in the contract.
+
+150
+00:09:46,000 --> 00:09:51,000
+The rules of engagement refers to the set of guidelines or protocols that outline how an organization's
+
+151
+00:09:51,000 --> 00:09:54,000
+interact and cooperate with third party vendors.
+
+152
+00:09:54,000 --> 00:09:58,000
+So how are we going to deal with that third party vendor?
+
+153
+00:09:58,000 --> 00:10:00,000
+How are we going to onboard them?
+
+154
+00:10:00,000 --> 00:10:01,000
+Can we do this?
+
+155
+00:10:01,000 --> 00:10:02,000
+Can we not do that with them?
+
+156
+00:10:03,000 --> 00:10:09,000
+Um, this is going to set a good baseline of what we should be expecting of them.
+
+157
+00:10:09,000 --> 00:10:12,000
+Maybe they got to have a yearly third party assessment done.
+
+158
+00:10:12,000 --> 00:10:14,000
+What's the responsibilities?
+
+159
+00:10:14,000 --> 00:10:16,000
+What's the boundaries set between them.
+
+160
+00:10:16,000 --> 00:10:20,000
+Now when it comes to assessing them, we went through a few things there.
+
+161
+00:10:20,000 --> 00:10:22,000
+At some point you got to select a vendor.
+
+162
+00:10:22,000 --> 00:10:25,000
+So this is going to be evaluated.
+
+163
+00:10:25,000 --> 00:10:27,000
+And choosing the best third party provider.
+
+164
+00:10:27,000 --> 00:10:36,000
+Like what's or who we should say is the vendor that meets your security posture or that meets the way
+
+165
+00:10:36,000 --> 00:10:43,000
+you want to do security, meets your recommendations or wants in terms of third party assessments.
+
+166
+00:10:43,000 --> 00:10:45,000
+Now, there's a couple of things that we want to mention.
+
+167
+00:10:45,000 --> 00:10:49,000
+The first thing you want to do before selecting any vendor is do your due diligence.
+
+168
+00:10:49,000 --> 00:10:50,000
+What is due diligence?
+
+169
+00:10:50,000 --> 00:10:58,000
+Well, it's basically a really comprehensive appraisal or evaluation of the vendors practices focusing
+
+170
+00:10:58,000 --> 00:11:00,000
+on cybersecurity policies, procedures.
+
+171
+00:11:00,000 --> 00:11:04,000
+So do do your due diligence.
+
+172
+00:11:04,000 --> 00:11:08,000
+Due diligence is doing all your homework, all your background information.
+
+173
+00:11:08,000 --> 00:11:12,000
+Check in things such as did they have some kind of third party compliance?
+
+174
+00:11:13,000 --> 00:11:14,000
+Are they ISO certified?
+
+175
+00:11:14,000 --> 00:11:16,000
+Did they have Soc2 reports.
+
+176
+00:11:16,000 --> 00:11:19,000
+These are going to be audits done by external organizations.
+
+177
+00:11:19,000 --> 00:11:23,000
+Did they get any past cyber cyber breach?
+
+178
+00:11:23,000 --> 00:11:25,000
+Is their reputation any good.
+
+179
+00:11:26,000 --> 00:11:28,000
+Go back ten years.
+
+180
+00:11:28,000 --> 00:11:30,000
+Did they get hacked at any point?
+
+181
+00:11:30,000 --> 00:11:32,000
+What was the what was the remediation?
+
+182
+00:11:32,000 --> 00:11:35,000
+How many times has this organization been hacked?
+
+183
+00:11:35,000 --> 00:11:39,000
+For example, what is the public's perception of this organization?
+
+184
+00:11:39,000 --> 00:11:41,000
+This is going to be your due diligence.
+
+185
+00:11:41,000 --> 00:11:46,000
+Uncover any potential security vulnerabilities and weaknesses before you're selecting them.
+
+186
+00:11:46,000 --> 00:11:51,000
+Now, one thing that you're going to want to keep in mind is this thing called conflict of interest.
+
+187
+00:11:51,000 --> 00:11:52,000
+What is it?
+
+188
+00:11:52,000 --> 00:11:57,000
+Well, this is going to be identifying and managing any conflict of interest.
+
+189
+00:11:57,000 --> 00:12:03,000
+It's arise when a vendor has listened carefully, competing interests that can influence your ability
+
+190
+00:12:03,000 --> 00:12:07,000
+to objectively and securely provide security services.
+
+191
+00:12:07,000 --> 00:12:15,000
+For example, let's say you hire an organization to do pen tests to do a pen test for you.
+
+192
+00:12:15,000 --> 00:12:19,000
+It's a third party vendor that you're going to be using to do a pen test.
+
+193
+00:12:19,000 --> 00:12:28,000
+But then you came to realize that the vendors, the vendor, their CEO, their let's say their owner
+
+194
+00:12:28,000 --> 00:12:35,000
+owns shares or owns a majority shares in a company that directly competes with you.
+
+195
+00:12:35,000 --> 00:12:41,000
+So your competitor is actually owned by the guy that's doing the pen test for you.
+
+196
+00:12:41,000 --> 00:12:47,000
+That's something that you want to know now, it's not illegal for them to own, you know, for anybody
+
+197
+00:12:47,000 --> 00:12:48,000
+to own a business.
+
+198
+00:12:48,000 --> 00:12:54,000
+But that is called a conflict of interest because can they really objectively analyze your organization?
+
+199
+00:12:54,000 --> 00:12:57,000
+Are they going to look for things that are going to steal your information?
+
+200
+00:12:57,000 --> 00:13:05,000
+So keep in mind these kinds of things do occur, and you have to do your due diligence to find out.
+
+201
+00:13:05,000 --> 00:13:12,000
+Is there any kind of conflict of interest you want to ensure transparency in any kind of impartial ability
+
+202
+00:13:12,000 --> 00:13:14,000
+with this now?
+
+203
+00:13:15,000 --> 00:13:20,000
+When you select your vendor, you have to monitor the vendor consistent monitoring of the vendor.
+
+204
+00:13:21,000 --> 00:13:24,000
+Continuous process assessing and overseeing third party.
+
+205
+00:13:24,000 --> 00:13:25,000
+Always keep an eye on the vendor.
+
+206
+00:13:25,000 --> 00:13:26,000
+Look at the news.
+
+207
+00:13:26,000 --> 00:13:29,000
+Look at all the problems and issues that arise with the vendor.
+
+208
+00:13:29,000 --> 00:13:36,000
+This includes regular evaluations of the security practices, incident capabilities, and making sure
+
+209
+00:13:36,000 --> 00:13:40,000
+that they stay relevant on the industry, industry compliance or regulation.
+
+210
+00:13:41,000 --> 00:13:45,000
+Now you want to proactively identify and manage potential security risks.
+
+211
+00:13:45,000 --> 00:13:48,000
+Because remember, the world of technology changes every day.
+
+212
+00:13:48,000 --> 00:13:52,000
+Keep in mind that today there's no problems with the vendor.
+
+213
+00:13:52,000 --> 00:13:55,000
+The vendor has great security practices.
+
+214
+00:13:55,000 --> 00:14:00,000
+He's in compliance right now to different kinds of certifications that they had to get, or different
+
+215
+00:14:00,000 --> 00:14:02,000
+kinds of third party audits.
+
+216
+00:14:02,000 --> 00:14:06,000
+But tomorrow there, they could be a new audit and the guy fails.
+
+217
+00:14:06,000 --> 00:14:10,000
+They could be a new, uh, pen test against them and they fail it.
+
+218
+00:14:10,000 --> 00:14:12,000
+They could be a new hack, and they lost all your data.
+
+219
+00:14:13,000 --> 00:14:18,000
+Remember, security is is basically an -- of, like, right now type thing.
+
+220
+00:14:18,000 --> 00:14:21,000
+You could be secured today and insecure tomorrow.
+
+221
+00:14:21,000 --> 00:14:26,000
+Let's keep that in mind when managing vendors because of the you know, one of the last things we want
+
+222
+00:14:26,000 --> 00:14:30,000
+is to bring security problems to our organization.
+

22 - Vendor Management/002 Vendor Agreements OB 5.3_en.srt

@@ -0,0 +1,484 @@
+1
+00:00:00,000 --> 00:00:06,000
+When it comes to managing the relationship between you and a vendor, you must have some kind of a contract.
+
+2
+00:00:06,000 --> 00:00:13,000
+Never manage a relationship between you and a third party vendor with just a handshake, or just talking
+
+3
+00:00:13,000 --> 00:00:14,000
+over the phone.
+
+4
+00:00:14,000 --> 00:00:17,000
+Just don't do it by words as they say.
+
+5
+00:00:17,000 --> 00:00:18,000
+Put it on paper.
+
+6
+00:00:18,000 --> 00:00:19,000
+Put it in writing.
+
+7
+00:00:19,000 --> 00:00:24,000
+So in this video, let's take a look at some different kinds of contractual agreements that we want
+
+8
+00:00:24,000 --> 00:00:25,000
+to be familiar with for our exam.
+
+9
+00:00:25,000 --> 00:00:27,000
+And what is it that they're going to have in them.
+
+10
+00:00:27,000 --> 00:00:29,000
+So what exactly are we talking about?
+
+11
+00:00:29,000 --> 00:00:35,000
+Well, when you select vendors, you must consider how well you're going to manage these vendors due
+
+12
+00:00:35,000 --> 00:00:39,000
+to contractual terms, such as having an SLA with them, which we'll cover in a minute.
+
+13
+00:00:39,000 --> 00:00:44,000
+Does these SLAs align with the organization's security expectations?
+
+14
+00:00:44,000 --> 00:00:49,000
+Things we're going to want to look for data protection, incident response, security audits, right
+
+15
+00:00:49,000 --> 00:00:57,000
+to audit clauses, all of these things here we can include in our um, in our different types of contracts.
+
+16
+00:00:57,000 --> 00:01:03,000
+So let's go see some different types of contracts that we're going to want to have with our vendors.
+
+17
+00:01:03,000 --> 00:01:07,000
+So the first one up I want to mention is one of the most popular ones you're going to have with a third
+
+18
+00:01:07,000 --> 00:01:08,000
+party vendor.
+
+19
+00:01:08,000 --> 00:01:11,000
+And that's going to be a service level agreement or SLA.
+
+20
+00:01:11,000 --> 00:01:15,000
+Now, this is a contract between a service provider and a client that specifies, quote unquote, the
+
+21
+00:01:15,000 --> 00:01:21,000
+level of service, hence the name service level agreement expected during the terms of the agreement.
+
+22
+00:01:21,000 --> 00:01:27,000
+This generally includes things like system uptime, response time or support requests and security measures.
+
+23
+00:01:27,000 --> 00:01:28,000
+Let me give you a bunch of examples.
+
+24
+00:01:29,000 --> 00:01:31,000
+When you get when you get a vendor.
+
+25
+00:01:31,000 --> 00:01:37,000
+For example, let's say you go to Verizon and you get a Verizon Internet line.
+
+26
+00:01:37,000 --> 00:01:45,000
+They're vendor, they're providing the service of internet, but you need your internet to be up 99.999%
+
+27
+00:01:45,000 --> 00:01:46,000
+of the time.
+
+28
+00:01:46,000 --> 00:01:47,000
+It's called the five nines.
+
+29
+00:01:47,000 --> 00:01:52,000
+99.999% of the time is a very high uptime.
+
+30
+00:01:52,000 --> 00:01:58,000
+So you could put in a contract if Verizon can say, well, our SLA is 99.999%.
+
+31
+00:01:58,000 --> 00:02:01,000
+In other words, their systems go down very little.
+
+32
+00:02:01,000 --> 00:02:03,000
+So you can put that in the SLA.
+
+33
+00:02:03,000 --> 00:02:09,000
+So the SLA is going to be 99.99% of the time, even incident response times, for example, if there
+
+34
+00:02:09,000 --> 00:02:15,000
+is a security incident or for example, if the internet line does go down, Verizon will fix it within
+
+35
+00:02:15,000 --> 00:02:19,000
+four hours, 2 hours or 24 hours, depending on what's in your SLA.
+
+36
+00:02:19,000 --> 00:02:27,000
+So the SLA is generally going to be some kind of level in the name service level that the organization,
+
+37
+00:02:27,000 --> 00:02:31,000
+the vendor in particular has to meet to keep that agreement active.
+
+38
+00:02:31,000 --> 00:02:32,000
+And what if they don't meet it?
+
+39
+00:02:32,000 --> 00:02:37,000
+Like, what if Verizon say they're going to fix all internet issues within four hours, but then it
+
+40
+00:02:37,000 --> 00:02:38,000
+actually took six hours?
+
+41
+00:02:38,000 --> 00:02:43,000
+Well, the SLA can actually specify penalties for the for the particular vendor.
+
+42
+00:02:43,000 --> 00:02:47,000
+The vendor may have to give you back service credits or refunds on future bills.
+
+43
+00:02:47,000 --> 00:02:52,000
+So this is going to be critical because if you're a manager in a server and it's basically managing
+
+44
+00:02:52,000 --> 00:02:57,000
+your own web server and you need a high uptime on on the internet line, make sure that your SLA is
+
+45
+00:02:57,000 --> 00:02:58,000
+a 99 point.
+
+46
+00:02:58,000 --> 00:03:00,000
+You never get 100%.
+
+47
+00:03:01,000 --> 00:03:04,000
+You know, they say the only thing that's 100% in this world is debt.
+
+48
+00:03:04,000 --> 00:03:06,000
+So you're not going to get 100%.
+
+49
+00:03:06,000 --> 00:03:08,000
+But all those nines is close enough.
+
+50
+00:03:08,000 --> 00:03:13,000
+So SLA is a critical for establishing performance benchmarks and consequences.
+
+51
+00:03:13,000 --> 00:03:19,000
+So it will have consequences, like I said, like if they don't meet it, it may they may have to give
+
+52
+00:03:19,000 --> 00:03:21,000
+you back some kind of service credit.
+
+53
+00:03:21,000 --> 00:03:27,000
+Another thing you have is an MOA or memo of agreement.
+
+54
+00:03:27,000 --> 00:03:32,000
+An MOA is a formal document outlining an agreement between two or more parties.
+
+55
+00:03:32,000 --> 00:03:38,000
+It's used to establish some kind of cooperative relationship, detailing the terms and scope of the
+
+56
+00:03:38,000 --> 00:03:38,000
+agreement.
+
+57
+00:03:38,000 --> 00:03:42,000
+Now, when it comes to cyber security, it's basically set out.
+
+58
+00:03:43,000 --> 00:03:48,000
+A joint initiative for information sharing and collaborative development of security protocols.
+
+59
+00:03:48,000 --> 00:03:55,000
+So a lot of times we're going to have memo of agreement with other organizations to sometimes work on
+
+60
+00:03:55,000 --> 00:03:57,000
+a joint project together.
+
+61
+00:03:57,000 --> 00:03:59,000
+That's very common when we do these things.
+
+62
+00:03:59,000 --> 00:04:03,000
+Hey, we're going to have this agreement that says, here's how we're going to share information, here's
+
+63
+00:04:03,000 --> 00:04:06,000
+how we're going to work together to finish a particular project.
+
+64
+00:04:07,000 --> 00:04:13,000
+Take for example, vendor A and vendor B, combining together to develop a new security product.
+
+65
+00:04:13,000 --> 00:04:15,000
+This is how they're going to share information.
+
+66
+00:04:15,000 --> 00:04:18,000
+These are this is what this one should do versus another.
+
+67
+00:04:18,000 --> 00:04:25,000
+Another thing you have is something that's less formal is what we just have a memo of understanding
+
+68
+00:04:25,000 --> 00:04:26,000
+our MOU.
+
+69
+00:04:26,000 --> 00:04:33,000
+Now it's typically used to outline a mutual agreement or a shared goal without keyword legal obligation.
+
+70
+00:04:33,000 --> 00:04:37,000
+So this is going to be more of when they outline, hey, this is how we're going to work together,
+
+71
+00:04:37,000 --> 00:04:41,000
+but they actually don't go in to the specifics.
+
+72
+00:04:41,000 --> 00:04:45,000
+And it's not something that if one wants to walk away from the other, one can take the other one to
+
+73
+00:04:45,000 --> 00:04:46,000
+court.
+
+74
+00:04:46,000 --> 00:04:50,000
+Now, it does facilitate information sharing, research, research, collaboration.
+
+75
+00:04:50,000 --> 00:04:56,000
+So it's really something that's less formal than an MOA.
+
+76
+00:04:57,000 --> 00:05:03,000
+Now, one of the main ones you're going to want to get is what's called a master service agreement.
+
+77
+00:05:03,000 --> 00:05:05,000
+This is a more comprehensive contract.
+
+78
+00:05:05,000 --> 00:05:11,000
+These sets the general terms governing future of transactions in all agreements between you and that
+
+79
+00:05:11,000 --> 00:05:13,000
+vendor can streamline future agreements.
+
+80
+00:05:13,000 --> 00:05:17,000
+And it often will include how are they going to protect the CIA.
+
+81
+00:05:17,000 --> 00:05:22,000
+So confidentiality, integrity and availability, any kind of disputes that may show up or any kind
+
+82
+00:05:22,000 --> 00:05:23,000
+of data security standard.
+
+83
+00:05:23,000 --> 00:05:30,000
+So the Master Service agreement is exactly how it's the big agreement that really dictates how the relationship
+
+84
+00:05:30,000 --> 00:05:33,000
+between you and the vendor will be managed.
+
+85
+00:05:33,000 --> 00:05:35,000
+Now to outline the specific work.
+
+86
+00:05:35,000 --> 00:05:38,000
+This is going to be called a work order or statement of work.
+
+87
+00:05:38,000 --> 00:05:42,000
+This is a document that specific details about the work to be performed.
+
+88
+00:05:42,000 --> 00:05:47,000
+So if you hire a vendor to work on a particular project or get particular task done for you, you're
+
+89
+00:05:47,000 --> 00:05:48,000
+going to want to make sure you add this in.
+
+90
+00:05:48,000 --> 00:05:52,000
+It must be detailed, like what is it that they're going to have to deliver?
+
+91
+00:05:52,000 --> 00:05:56,000
+When are timelines, specific tasks and the responsibilities?
+
+92
+00:05:56,000 --> 00:05:59,000
+For example, let's say you hire somebody to build a website.
+
+93
+00:05:59,000 --> 00:06:01,000
+You should have a statement of work for them.
+
+94
+00:06:01,000 --> 00:06:02,000
+This is what you want.
+
+95
+00:06:02,000 --> 00:06:03,000
+These are the pages.
+
+96
+00:06:03,000 --> 00:06:08,000
+This is what should be on the pages if it's in terms of security.
+
+97
+00:06:08,000 --> 00:06:13,000
+If it's particularly like if it's a security project, what should be configured, how should be configured,
+
+98
+00:06:13,000 --> 00:06:17,000
+what type of audits or tests or implementations we need to get done.
+
+99
+00:06:18,000 --> 00:06:19,000
+A non-disclosure.
+
+100
+00:06:19,000 --> 00:06:24,000
+Any time you work with a vendor, you should always have a non-disclosure agreement.
+
+101
+00:06:24,000 --> 00:06:30,000
+This is a legal binding contract that establishes that confidential relationship now.
+
+102
+00:06:30,000 --> 00:06:39,000
+Basically it's a it's an agreement that says no one is to disclose information covered by the agreement,
+
+103
+00:06:39,000 --> 00:06:40,000
+which is critical.
+
+104
+00:06:40,000 --> 00:06:45,000
+For example, if you're dealing with a vendor and that vendor comes into your organization, they may
+
+105
+00:06:45,000 --> 00:06:45,000
+find.
+
+106
+00:06:46,000 --> 00:06:52,000
+Private information about your customers, maybe even secret projects that you're working on, maybe
+
+107
+00:06:52,000 --> 00:06:55,000
+specific way you deal your business or business secrets.
+
+108
+00:06:56,000 --> 00:07:03,000
+They can technically share that information with anyone, but if they sign an NDA, they're not supposed
+
+109
+00:07:03,000 --> 00:07:04,000
+to disclose that information to anyone.
+
+110
+00:07:04,000 --> 00:07:07,000
+So this becomes a legal contract that says, you know what?
+
+111
+00:07:07,000 --> 00:07:11,000
+Whatever I find in this organization, I can't disclose it.
+
+112
+00:07:11,000 --> 00:07:13,000
+So that's why this is important.
+
+113
+00:07:13,000 --> 00:07:18,000
+So it's critical for protecting sensitive data, especially proprietary information.
+
+114
+00:07:19,000 --> 00:07:23,000
+Now another agreement you may see is a business partners agreement.
+
+115
+00:07:23,000 --> 00:07:28,000
+This is going to be when business people combine together, share resources, joint ventures or work
+
+116
+00:07:28,000 --> 00:07:30,000
+on different types of projects.
+
+117
+00:07:30,000 --> 00:07:35,000
+Together they're going to sign a business partner agreement to say, here, let's combine together to
+
+118
+00:07:35,000 --> 00:07:39,000
+develop certain security products, software, hardware and so on.
+
+119
+00:07:39,000 --> 00:07:42,000
+Okay, just be familiar with some of these agreements.
+
+120
+00:07:42,000 --> 00:07:44,000
+You might see them, they show up on your exam.
+
+121
+00:07:44,000 --> 00:07:51,000
+But keep in mind, never manage a vendor without having the correct agreement or contract in place.
+

22 - Vendor Management/003 Quick Quiz.html

@@ -0,0 +1,479 @@
+<!DOCTYPE html>
+<html lang="en">
+    <head>
+        <meta charset="UTF-8" />
+        <meta http-equiv="X-UA-Compatible" content="IE=edge" />
+        <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+        <title>Quiz</title>
+        <style>
+            * {
+                font-family: system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Oxygen, Ubuntu, Cantarell,
+                    "Open Sans", "Helvetica Neue", sans-serif;
+                margin: 0;
+                padding: 0;
+                box-sizing: border-box;
+                font-size: 16px;
+            }
+
+            main {
+                padding-top: 48px;
+            }
+
+            :root {
+                --large-device-width: 850px;
+                --primary-color: #0f172a;
+                --secondary-color: #020617;
+                --primary-text-color: #c7d1dd;
+                --secondary-text-color: #061602;
+                --success-background: hsl(159, 82%, 24%);
+                --success-foreground: hsl(164, 86%, 16%);
+                --success: hsl(160, 84%, 39%);
+                --danger: #ef4444;
+                --warning: #f59e0b;
+                --info-background: hsl(218, 81%, 8%);
+                --info-foreground: hsl(217, 91%, 85%);
+                --border-color: #d1d7dc;
+                --check-box-size: 20px;
+                /* control the size */
+                --check-box-color: var(--info-foreground);
+                /* the active color */
+            }
+
+            body {
+                position: relative;
+                background-color: #020617;
+                color: var(--primary-text-color);
+            }
+
+            #score-stats-container {
+                position: fixed;
+                z-index: 10;
+                top: 0;
+                height: 40px;
+                width: 100%;
+                background-color: var(--info-background);
+
+                padding: 0px 16px;
+                color: var(--info-foreground);
+                font-weight: 600;
+                display: flex;
+                align-items: center;
+                justify-content: space-between;
+            }
+
+            #quiz-container {
+                border-radius: 8px;
+                display: flex;
+                gap: 16px;
+                flex-direction: column;
+            }
+
+            input[type="radio"] {
+                height: var(--check-box-size);
+                aspect-ratio: 1;
+                border: calc(var(--check-box-size) / 8) solid #939393;
+                padding: calc(var(--check-box-size) / 8);
+                background: radial-gradient(farthest-side, var(--check-box-color) 94%, #0000) 50%/0 0 no-repeat
+                    content-box;
+                border-radius: 50%;
+                outline-offset: calc(var(--check-box-size) / 10);
+                -webkit-appearance: none;
+                -moz-appearance: none;
+                appearance: none;
+                cursor: pointer;
+                font-size: inherit;
+                transition: 0.3s;
+            }
+
+            input[type="radio"]:checked {
+                border-color: var(--check-box-color);
+                background-size: 100% 100%;
+            }
+
+            input[type="radio"]:disabled {
+                background: linear-gradient(#939393 0 0) 50%/100% 20% no-repeat content-box;
+                opacity: 0.5;
+                cursor: not-allowed;
+            }
+
+            label {
+                display: inline-flex;
+                align-items: center;
+                gap: 10px;
+                cursor: pointer;
+                padding: 4px 6px;
+                border-radius: 4px;
+            }
+
+            @media (max-width: 767px) {
+                input[type="radio"],
+                label {
+                    cursor: default;
+                }
+
+                #quiz-container {
+                    margin-left: 8px;
+                    margin-right: 8px;
+                }
+            }
+
+            /* PC (Desktop devices) */
+            @media (min-width: 768px) {
+                body {
+                    display: flex;
+                    justify-content: center;
+                }
+
+                main {
+                    max-width: var(--large-device-width);
+                }
+
+                #score-stats-container {
+                    max-width: var(--large-device-width);
+                }
+
+                dialog {
+                    max-width: var(--large-device-width);
+                }
+            }
+
+            @media print {
+                input[type="radio"] {
+                    background: none !important;
+                    border-color: #939393 !important;
+                }
+
+                input[type="radio"]:checked {
+                    border-color: #939393 !important;
+                }
+            }
+
+            .question-lable {
+                display: flex;
+                align-items: center;
+                gap: 8px;
+            }
+
+            button {
+                -webkit-tap-highlight-color: transparent;
+                -webkit-touch-callout: none;
+                -webkit-user-select: none;
+                user-select: none;
+                outline: none;
+                position: relative;
+                overflow: hidden;
+                cursor: pointer;
+            }
+
+            .button {
+                background-color: var(--success-background);
+                border: none;
+                color: #f4f5f7;
+                opacity: 0.8;
+                font-size: 18px;
+                flex-grow: 1;
+                padding: 8px 16px;
+                border-radius: 8px;
+            }
+
+            .button:hover {
+                opacity: 1;
+            }
+
+            .explanation-btn {
+                border: none;
+                color: var(--success);
+                background-color: transparent;
+            }
+
+            #submit-button:active::after {
+                background-color: #ef4444;
+            }
+
+            .single-question-container {
+                background-color: var(--primary-color);
+                display: flex;
+                flex-direction: column;
+                gap: 8px;
+                padding: 16px;
+                border-radius: 8px;
+            }
+
+            #modal-content {
+                padding: 16px;
+                line-height: 24px;
+            }
+
+            dialog::backdrop {
+                background: rgba(0, 0, 0, 0.5);
+            }
+
+            dialog {
+                position: fixed;
+                border: 1px solid var(--border-color);
+                background-color: var(--primary-color);
+                color: rgb(240, 241, 248);
+                padding: 16px;
+                border-radius: 8px;
+                width: 80vw;
+                max-height: 80vh;
+                overflow: auto;
+                top: 50%;
+                left: 50%;
+                -webkit-transform: translateX(-50%) translateY(-50%);
+                -moz-transform: translateX(-50%) translateY(-50%);
+                -ms-transform: translateX(-50%) translateY(-50%);
+                transform: translateX(-50%) translateY(-50%);
+            }
+
+            #close-modal-btn {
+                position: absolute;
+                top: 4px;
+                right: 4px;
+                padding: 2px 8px;
+                border-radius: 2px;
+                border: none;
+                background-color: var(--danger);
+            }
+
+            .correct-answer label {
+                border: 2px solid var(--success);
+                width: 100%;
+            }
+
+            .incorrect-answer label {
+                border: 2px solid var(--danger);
+                width: 100%;
+            }
+
+            .options-container {
+                display: flex;
+                flex-direction: column;
+                gap: 4px;
+            }
+
+            #quiz-meta-container {
+                border-radius: 8px;
+                background-color: var(--primary-color);
+                margin-bottom: 12px;
+                padding: 8px;
+            }
+
+            #quiz-title {
+                text-align: center;
+                font-size: 24px;
+                margin-bottom: 8px;
+            }
+
+            #quiz-description {
+                line-height: 1.5;
+                padding: 2px 6px;
+            }
+        </style>
+    </head>
+
+    <body onload="main()">
+        <main>
+            <section id="quiz-meta-container">
+                <h1 id="quiz-title"></h1>
+                <p id="quiz-description"></p>
+            </section>
+            <section id="score-stats-container">
+                <div id="score-card">
+                    Score: <span id="current-score">999</span> of
+                    <span id="pass-percent">999%</span>
+                </div>
+                <div>Correct: <span id="correct-answers">999</span></div>
+                <div>Incorrect: <span id="wrong-answers">999</span></div>
+            </section>
+
+            <section id="quiz-container"></section>
+
+            <dialog id="modal" class="modal-container">
+                <div id="modal-content">
+                    <p id="modal-text"></p>
+                </div>
+            </dialog>
+        </main>
+
+        <script>
+            const quizData = {"quiz_id": 6180190, "quiz_description": null, "quiz_title": "Quick Quiz", "pass_percent": null, "questions": [{"_class": "assessment", "id": 74731654, "assessment_type": "multiple-choice", "prompt": {"question": "<p>A corporation is planning to hire a third-party IT service provider. What is the initial step they should take to ensure the provider meets their security requirements?</p>", "relatedLectureIds": "", "feedbacks": ["", "The initial step for the corporation should be conducting a Vendor Assessment. This process involves evaluating the potential vendor's security measures, which might include penetration testing results, evidence of their internal audits, independent assessments, and supply chain analysis. This assessment helps in understanding if the vendor can meet the corporation's security requirements. ", "", ""], "answers": ["<p>Signing a Non-disclosure Agreement (NDA)</p>", "<p>Conducting a Vendor Assessment</p>", "<p>Establishing a Service-Level Agreement (SLA)</p>", "<p>Preparing a Work Order (WO)/Statement of Work (SOW)</p>"]}, "correct_response": ["b"], "section": "", "question_plain": "A corporation is planning to hire a third-party IT service provider. What is the initial step they should take to ensure the provider meets their security requirements?", "related_lectures": []}, {"_class": "assessment", "id": 74731658, "assessment_type": "multiple-choice", "prompt": {"question": "<p>A financial institution is selecting a new software vendor for its transaction processing system. What process should they prioritize to avoid conflicts of interest and ensure the vendor aligns with their operational needs?</p>", "relatedLectureIds": "", "feedbacks": ["", "", "The financial institution should prioritize performing Due Diligence in the Vendor Selection process. Due diligence involves a comprehensive evaluation of the vendor\u2019s capabilities, financial stability, reputation, and compliance with regulations, ensuring that there are no conflicts of interest and that the vendor aligns with the institution's operational needs and standards. ", ""], "answers": ["<p>Implementing Vendor Monitoring</p>", "<p>Executing a Memorandum of Understanding (MOU)</p>", "<p>Performing Due Diligence in Vendor Selection</p>", "<p>Drafting a Business Partners Agreement (BPA)</p>"]}, "correct_response": ["c"], "section": "", "question_plain": "A financial institution is selecting a new software vendor for its transaction processing system. What process should they prioritize to avoid conflicts of interest and ensure the vendor aligns with their operational needs?", "related_lectures": []}, {"_class": "assessment", "id": 74731670, "assessment_type": "multiple-choice", "prompt": {"question": "<p>A technology company is evaluating several vendors for a new project. What tool should they use to gather detailed information about the vendors' policies, practices, and capabilities?</p>", "relatedLectureIds": "", "feedbacks": ["The technology company should use Vendor Questionnaires as a tool to gather detailed information about the vendors' policies, practices, and capabilities. These questionnaires are designed to extract specific information that helps in evaluating the vendors' qualifications, security measures, compliance with industry standards, and overall suitability for the project. ", "", "", ""], "answers": ["<p>Vendor Questionnaires</p>", "<p>Service-Level Agreements (SLAs)</p>", "<p>Memorandum of Understanding (MOU)</p>", "<p>Business Partners Agreement (BPA)</p>"]}, "correct_response": ["a"], "section": "", "question_plain": "A technology company is evaluating several vendors for a new project. What tool should they use to gather detailed information about the vendors' policies, practices, and capabilities?", "related_lectures": []}, {"_class": "assessment", "id": 74731800, "assessment_type": "multiple-choice", "prompt": {"question": "<p>A multinational corporation is drafting agreements with multiple vendors for a series of international projects. What type of agreement is essential to protect confidential information shared during vendor interactions?</p>", "relatedLectureIds": "", "feedbacks": ["For the multinational corporation, a Non-disclosure Agreement (NDA) is essential in their agreements with vendors, especially to protect confidential information. NDAs legally bind the vendors to confidentiality, ensuring that sensitive information shared during negotiations, project planning, and execution is not disclosed to unauthorized parties. ", "", "", ""], "answers": ["<p>Non-disclosure Agreement (NDA)</p>", "<p>Service-level Agreement (SLA)</p>", "<p>Memorandum of Understanding (MOU)</p>", "<p>Master Service Agreement (MSA)</p>"]}, "correct_response": ["a"], "section": "", "question_plain": "A multinational corporation is drafting agreements with multiple vendors for a series of international projects. What type of agreement is essential to protect confidential information shared during vendor interactions?", "related_lectures": []}, {"_class": "assessment", "id": 74731872, "assessment_type": "multiple-choice", "prompt": {"question": "<p>A manufacturing company is outsourcing part of its production to a third-party vendor. To maintain quality control and manage potential supply chain risks, what strategy should they employ in their agreement with the vendor?</p>", "relatedLectureIds": "", "feedbacks": ["For the manufacturing company outsourcing production, including a Right-to-Audit clause in the agreement with the third-party vendor is a critical strategy to maintain quality control and manage supply chain risks. This clause allows the company to conduct periodic audits of the vendor's processes, ensuring that they adhere to agreed-upon quality standards and production timelines.", "", "", ""], "answers": ["<p>Including a Right-to-Audit clause in the agreement</p>", "<p>Focusing on the financial terms in the Service-Level Agreement (SLA)</p>", "<p>Establishing a Memorandum of Understanding (MOU) for shared objectives</p>", "<p>Drafting a detailed Work Order (WO)/Statement of Work (SOW)</p>"]}, "correct_response": ["a"], "section": "", "question_plain": "A manufacturing company is outsourcing part of its production to a third-party vendor. To maintain quality control and manage potential supply chain risks, what strategy should they employ in their agreement with the vendor?", "related_lectures": []}]};
+            let correct = new Set();
+            let incorrect = new Set();
+            let totalNumberOfQuestions = 0;
+            const quizTitle = quizData.quiz_title;
+            const quizDescription = quizData.quiz_description;
+            const questionData = quizData.questions;
+            const passPercent = quizData.pass_percent;
+            const modalTextElement = document.getElementById("modal-text");
+            const quizContainerElement = document.getElementById("quiz-container");
+
+            const dialog = document.querySelector("dialog");
+            const showButton = document.getElementById("view-explanatin");
+            const closeButton = document.getElementById("close-modal-btn");
+            const quizTitleElement = document.getElementById("quiz-title");
+            const quizDescriptionElement = document.getElementById("quiz-description");
+
+            function main() {
+                // update quiz meta data
+                document.title = quizTitle;
+                quizTitleElement.innerHTML = quizTitle;
+                quizDescriptionElement.innerHTML = quizDescription;
+
+                const passPercentElement = document.getElementById("pass-percent");
+                passPercentElement.innerHTML = passPercent + "%";
+                totalNumberOfQuestions = questionData.length;
+                // shuffle the questionData to randomize the order of the questions
+                for (let i = questionData.length - 1; i > 0; i--) {
+                    const j = Math.floor(Math.random() * (i + 1));
+                    [questionData[i], questionData[j]] = [questionData[j], questionData[i]];
+                }
+
+                let formattedQuestions = questionData.map(formatSingleQuestionData);
+                updateScore();
+                // display the formattedQuestions
+                formattedQuestions.forEach((question, idx) => {
+                    renderSingleQuestion(question, idx + 1);
+                });
+            }
+
+            /**
+             * Formats the question data from the given QuizData object.
+             *
+             * @param {Object} singleQuizData - The singleQuizData object containing prompt and correct_response.
+             * @return {Object} The formatted question object with the following properties:
+             *   - id: The ID of the question.
+             *   - question: The text of the question.
+             *   - answers: The array of answer options.
+             *   - correctAnswer: The text of the correct answer.
+             *   - explanation: The explanation of the correct answer.
+             */
+            function formatSingleQuestionData(singleQuizData = null) {
+                const { prompt, correct_response, id } = singleQuizData;
+                const questionText = prompt.question;
+                const answers = prompt.answers;
+                const correctAnswer = correct_response[0];
+                const correctAnswerText = answers[correctAnswer.toLowerCase().charCodeAt(0) - 97];
+                const questionObj = {
+                    id: id,
+                    question: questionText,
+                    answers: answers,
+                    correctAnswer: correctAnswerText,
+                    explanation: prompt?.explanation || "",
+                };
+                return questionObj;
+            }
+
+            /**
+             * Renders a single question with its options and submit button.
+             *
+             * @param {Object} singleQuestionData - The data of the question to render.
+             * @param {number} rootIndex - The index of the question in the quiz.
+             * @return {void} return nothing.
+             */
+
+            const renderSingleQuestion = (singleQuestionData = {}, rootIndex = 1) => {
+                const { id, explanation, answers, correctAnswer, question } = singleQuestionData;
+                // shuffle the answers to randomize the order of the answers
+                for (let i = answers.length - 1; i > 0; i--) {
+                    const j = Math.floor(Math.random() * (i + 1));
+                    [answers[i], answers[j]] = [answers[j], answers[i]];
+                }
+                const optionsHTML = answers
+                    .map((option, index) => {
+                        const optionId = `${id}_${index}`;
+
+                        return `
+        <div class="question-lable">
+          <input type="radio" id="${optionId}" name="${"answer"}" value="${option}" />
+          <label for="${optionId}">${option}</label>
+        </div>
+      `;
+                    })
+
+                    .join("");
+
+                const container = document.createElement("div");
+                container.innerHTML = `
+        <form data-correct-answer="${correctAnswer}" data-question-id="${id}" class="single-question-container" onsubmit="submitButtonListener(event)">
+          <div style="display: flex;justify-content: space-between;">
+            <p style="font-weight: 600">Question ${rootIndex}:</p>
+            <button type="button" onclick="renderExplanation(event)" id="${`explanation-${id}`}" data-explanation="${explanation}" class="explanation-btn">View Explanation</button>
+          </div>
+          <p style="margin-bottom: 8px;line-height: 1.5">${question}</p>
+          <div class="options-container">
+            ${optionsHTML}
+          </div>
+          <div style="display: flex; gap: 8px;">
+            <button type="submit" id="submit-button" class="button">Submit</button>
+          </div>
+        </form>
+      `;
+                quizContainerElement.appendChild(container);
+            };
+
+            /**
+             * Updates the score on the page based on the number of correct and incorrect answers.
+             *
+             * @return {void} This function does not return a value.
+             */
+            function updateScore() {
+                const currentParcentageElement = document.getElementById("current-score");
+                const correctAnswerElement = document.getElementById("correct-answers");
+                const wrongAnswerElement = document.getElementById("wrong-answers");
+                correctAnswerElement.innerHTML = correct.size;
+                wrongAnswerElement.innerHTML = incorrect.size;
+                const score = Number((correct.size / totalNumberOfQuestions) * 100).toFixed(2);
+                currentParcentageElement.innerHTML = score;
+            }
+
+            /**
+             * Handles the event when the submit button is clicked.
+             *
+             * @param {Event} e - The event object.
+             * @return {void} This function does not return anything.
+             */
+            const submitButtonListener = (e) => {
+                e.preventDefault();
+                const formData = new FormData(e.target);
+                const form = e.target;
+                const selectedOption = e.target.querySelector('input[type="radio"]:checked');
+                if (!selectedOption) {
+                    alert("Please select an answer!");
+                    return;
+                }
+
+                let isCorrect = false;
+                const { answer: userAnswer } = Object.fromEntries(formData.entries());
+                const correctAnswer = e.target.dataset.correctAnswer;
+                const questionId = e.target.dataset.questionId;
+                if (userAnswer == correctAnswer) {
+                    correct.add(questionId);
+                    incorrect.delete(questionId);
+                    isCorrect = true;
+                } else {
+                    incorrect.add(e.target.dataset.questionId);
+                    correct.delete(questionId);
+                }
+                updateScore();
+
+                const resultClass = isCorrect ? "correct-answer" : "incorrect-answer";
+
+                form.querySelectorAll(".question-lable").forEach((label) => {
+                    label.classList.remove("correct-answer", "incorrect-answer");
+                });
+                selectedOption.closest(".question-lable").classList.add(resultClass);
+            };
+
+            function renderExplanation(ev) {
+                modalTextElement.innerHTML = ev.target.dataset?.explanation || "no explanation found";
+                dialog.showModal();
+                dialog.addEventListener("click", (event) => {
+                    if (event.target === dialog) {
+                        dialog.close();
+                    }
+                });
+            }
+        </script>
+    </body>
+</html>

23 - Physical Security/001 Physical Security OB 1.2_en.srt

@@ -0,0 +1,640 @@
+1
+00:00:00,000 --> 00:00:08,000
+IT security professionals mostly think about how do we secure our data from technical attacks such as
+
+2
+00:00:08,000 --> 00:00:09,000
+hackers.
+
+3
+00:00:09,000 --> 00:00:16,000
+But reality says this it doesn't matter how much technical controls you put in place, such as you can
+
+4
+00:00:16,000 --> 00:00:22,000
+have great firewalls, encryption, anti-malware, intrusion prevention systems, and all the other
+
+5
+00:00:22,000 --> 00:00:24,000
+things that we're going to talk about later in this course.
+
+6
+00:00:24,000 --> 00:00:29,000
+See, it doesn't matter how much technical security you have, if I have the ability just to walk into
+
+7
+00:00:29,000 --> 00:00:34,000
+your organization, pick up your server and walk back out, you really don't have much security, do
+
+8
+00:00:34,000 --> 00:00:35,000
+you?
+
+9
+00:00:36,000 --> 00:00:39,000
+You see, the topic in this video is called physical security.
+
+10
+00:00:39,000 --> 00:00:46,000
+And when we protect our organization, just don't protect it from theft of digital data, protect it
+
+11
+00:00:46,000 --> 00:00:50,000
+from the theft of the physical server that stores the data.
+
+12
+00:00:50,000 --> 00:00:52,000
+So let's get more into physical security.
+
+13
+00:00:52,000 --> 00:00:57,000
+And also in this video I want to go through some different controls within physical security.
+
+14
+00:00:57,000 --> 00:00:59,000
+You want to be familiar with for your exam.
+
+15
+00:00:59,000 --> 00:01:01,000
+So the first thing up what exactly is this.
+
+16
+00:01:01,000 --> 00:01:06,000
+Well it's a critical aspect that focuses on protecting an organization's assets.
+
+17
+00:01:06,000 --> 00:01:08,000
+And it's mostly going to be physical assets.
+
+18
+00:01:08,000 --> 00:01:14,000
+Think building equipment and personnel from physical actions and events that can cause serious loss
+
+19
+00:01:14,000 --> 00:01:15,000
+or damage.
+
+20
+00:01:15,000 --> 00:01:16,000
+Now I want to point out something.
+
+21
+00:01:17,000 --> 00:01:21,000
+One of the most important assets that you're going to be protecting in physical security is going to
+
+22
+00:01:21,000 --> 00:01:22,000
+be people's lives.
+
+23
+00:01:22,000 --> 00:01:25,000
+Because when you think physical security, don't think of just theft.
+
+24
+00:01:25,000 --> 00:01:29,000
+Most people think, well, it's a thief coming in to steal a server.
+
+25
+00:01:29,000 --> 00:01:30,000
+Not particularly.
+
+26
+00:01:30,000 --> 00:01:34,000
+Remember, physical security protects against a wide variety of things like fire.
+
+27
+00:01:34,000 --> 00:01:40,000
+Not only can that destroy, that can take lives, flood, natural disasters like hurricanes, earthquakes,
+
+28
+00:01:40,000 --> 00:01:42,000
+burglary, theft, vandalism, and even terrorism.
+
+29
+00:01:42,000 --> 00:01:44,000
+Always remember something.
+
+30
+00:01:44,000 --> 00:01:49,000
+It doesn't matter how sophisticated your IT security is or your technical security is.
+
+31
+00:01:49,000 --> 00:01:54,000
+Keep in mind that it could be rendered ineffective if your physical security is compromised.
+
+32
+00:01:54,000 --> 00:01:59,000
+Now I'm going to go through some physical security controls in this video with you.
+
+33
+00:01:59,000 --> 00:02:02,000
+I want you to understand what these things are for your exam.
+
+34
+00:02:02,000 --> 00:02:03,000
+Don't go in depth into them.
+
+35
+00:02:03,000 --> 00:02:06,000
+Your exam won't, but just know what these controls are.
+
+36
+00:02:06,000 --> 00:02:07,000
+So let's get started.
+
+37
+00:02:07,000 --> 00:02:08,000
+Now.
+
+38
+00:02:08,000 --> 00:02:11,000
+They're not in any particular order per se that you need to have this.
+
+39
+00:02:11,000 --> 00:02:14,000
+Just know that these things exist and know what they do.
+
+40
+00:02:14,000 --> 00:02:19,000
+The first one up is something that you've probably seen many times, and these are going to be this
+
+41
+00:02:19,000 --> 00:02:22,000
+big post that you see, like this one here, the silver one.
+
+42
+00:02:22,000 --> 00:02:24,000
+This is going to be like the one in front of a building.
+
+43
+00:02:25,000 --> 00:02:28,000
+This yellow one is going to be like the one that you see in the parking lot.
+
+44
+00:02:28,000 --> 00:02:32,000
+Now what these things are, they're basically called bollards.
+
+45
+00:02:33,000 --> 00:02:38,000
+Now bollards are basically sturdy vertical posts, and they're designed to prevent car based attacks
+
+46
+00:02:38,000 --> 00:02:41,000
+on buildings or to control access to sensitive areas.
+
+47
+00:02:41,000 --> 00:02:47,000
+So basically, if you put this in front of your building, somebody can't run a car directly into your
+
+48
+00:02:47,000 --> 00:02:48,000
+building or a truck.
+
+49
+00:02:48,000 --> 00:02:53,000
+These things will withstand the force of a car going many miles per hour.
+
+50
+00:02:53,000 --> 00:03:00,000
+Another thing here we're going to have is something we call an access control vestibule.
+
+51
+00:03:00,000 --> 00:03:03,000
+Now, depending on what you read in, this thing used to be called a mantrap.
+
+52
+00:03:03,000 --> 00:03:06,000
+If you ever read old security texts used to be called that.
+
+53
+00:03:06,000 --> 00:03:09,000
+Now it's called an access control vestibule.
+
+54
+00:03:09,000 --> 00:03:16,000
+This is a secure area between two sets of doors used to manage and control access into a secure area.
+
+55
+00:03:17,000 --> 00:03:19,000
+Here's how it works, by the way.
+
+56
+00:03:19,000 --> 00:03:20,000
+Here's a picture of it.
+
+57
+00:03:20,000 --> 00:03:21,000
+Here's how it works.
+
+58
+00:03:21,000 --> 00:03:24,000
+Let's say you want to get into and these are famous.
+
+59
+00:03:24,000 --> 00:03:26,000
+You see these in like prison movies.
+
+60
+00:03:26,000 --> 00:03:27,000
+You want to get into a prison.
+
+61
+00:03:27,000 --> 00:03:29,000
+So there's going to be two doors.
+
+62
+00:03:29,000 --> 00:03:29,000
+Okay.
+
+63
+00:03:29,000 --> 00:03:37,000
+So let's say you enter from this door and in, and when you enter from this door, there's a pathway
+
+64
+00:03:37,000 --> 00:03:38,000
+to the next door.
+
+65
+00:03:38,000 --> 00:03:44,000
+And in order for the second door to open, because the second door is what takes you to the secure area,
+
+66
+00:03:44,000 --> 00:03:45,000
+you first have to enter this door.
+
+67
+00:03:45,000 --> 00:03:49,000
+And then there's some kind of authentication between the two doors.
+
+68
+00:03:49,000 --> 00:03:54,000
+For example, in a prison, the authentication between the two doors is generally a security guard or
+
+69
+00:03:54,000 --> 00:03:58,000
+somebody checking your ID, or it could be checking to see if you have any kind of weapons or something.
+
+70
+00:03:59,000 --> 00:04:05,000
+So you open this door, you go in, you're checked to make sure that you're you match the correct identification.
+
+71
+00:04:05,000 --> 00:04:07,000
+Maybe you check to see if you have any kind of weapons.
+
+72
+00:04:07,000 --> 00:04:09,000
+Then the second door opens.
+
+73
+00:04:09,000 --> 00:04:11,000
+Then you can go in to the secure area.
+
+74
+00:04:12,000 --> 00:04:17,000
+Now it's not just used in prison, but they're used in a wide variety of places in it.
+
+75
+00:04:17,000 --> 00:04:19,000
+For example, in data centers.
+
+76
+00:04:19,000 --> 00:04:21,000
+You're going to find this quite often.
+
+77
+00:04:21,000 --> 00:04:27,000
+Now it's generally equipped with some kind of biometric scanners, metal detectors and other security
+
+78
+00:04:27,000 --> 00:04:31,000
+measures that only authorized individuals will gain access to.
+
+79
+00:04:32,000 --> 00:04:34,000
+Now, the other one here you have is FinCEN.
+
+80
+00:04:34,000 --> 00:04:35,000
+Now, you're pretty much familiar with FinCEN.
+
+81
+00:04:35,000 --> 00:04:40,000
+As you can see in this picture here, fences are used to secure perimeters of a property.
+
+82
+00:04:40,000 --> 00:04:45,000
+Now high security fences are going to be topped with barbed wire and other deterrents to prevent unauthorized
+
+83
+00:04:45,000 --> 00:04:45,000
+entry.
+
+84
+00:04:45,000 --> 00:04:51,000
+Remember something a fence is good to secure perimeter and show where where the perimeter of a building
+
+85
+00:04:51,000 --> 00:04:51,000
+is.
+
+86
+00:04:52,000 --> 00:04:53,000
+Video surveillance.
+
+87
+00:04:53,000 --> 00:04:58,000
+Security guards don't have eyes to see an entire space all around.
+
+88
+00:04:58,000 --> 00:04:59,000
+But if you have.
+
+89
+00:04:59,000 --> 00:05:00,000
+Good video surveillance.
+
+90
+00:05:00,000 --> 00:05:02,000
+And I'm talking cameras as we have in this picture.
+
+91
+00:05:03,000 --> 00:05:11,000
+This can allow one basically one guard or one person and nowadays even software to watch large plots
+
+92
+00:05:11,000 --> 00:05:12,000
+of areas.
+
+93
+00:05:12,000 --> 00:05:17,000
+So they're able to monitor activities in and around a facility.
+
+94
+00:05:17,000 --> 00:05:22,000
+Now the good thing about cameras is they act as a good deterrent to prevent unauthorized actions and
+
+95
+00:05:22,000 --> 00:05:27,000
+can provide vulnerable evidence so people are less likely to steal things.
+
+96
+00:05:27,000 --> 00:05:31,000
+Or it might be deter to steal something or break in if they see, oh, look at that.
+
+97
+00:05:31,000 --> 00:05:32,000
+That camera is watching me.
+
+98
+00:05:32,000 --> 00:05:36,000
+So they might say, you know what, I don't want to do that because I don't want to get caught.
+
+99
+00:05:36,000 --> 00:05:40,000
+And if I do get caught, they're going to have the evidence in the camera footage.
+
+100
+00:05:41,000 --> 00:05:45,000
+Now sometimes you just need a person there.
+
+101
+00:05:45,000 --> 00:05:52,000
+If there's any kind of discretionary or discretion that has to be made, something that needs to be
+
+102
+00:05:52,000 --> 00:05:52,000
+checked.
+
+103
+00:05:52,000 --> 00:05:54,000
+Software is generally not the most reliable.
+
+104
+00:05:54,000 --> 00:05:56,000
+Sometimes you need that physical security guard.
+
+105
+00:05:56,000 --> 00:06:01,000
+Unfortunately, we don't have robots that can restrain or physically stop people, but a security guard
+
+106
+00:06:01,000 --> 00:06:02,000
+could.
+
+107
+00:06:02,000 --> 00:06:06,000
+So security guard is that human presence is a critical component of physical security.
+
+108
+00:06:06,000 --> 00:06:13,000
+Remember, we really don't have basically robots that can get up and catch someone running or somebody
+
+109
+00:06:13,000 --> 00:06:16,000
+that can physically stop someone from entering a building.
+
+110
+00:06:16,000 --> 00:06:19,000
+That's what human personnel are for until robots come along.
+
+111
+00:06:19,000 --> 00:06:20,000
+But that's not yet.
+
+112
+00:06:20,000 --> 00:06:25,000
+So guard they can monitor, they conduct patrols, they respond to incidents, and they're going to
+
+113
+00:06:25,000 --> 00:06:26,000
+control access.
+
+114
+00:06:26,000 --> 00:06:28,000
+You're allowed in and you're not allowed in.
+
+115
+00:06:29,000 --> 00:06:34,000
+Generally, it's pretty common within organizations today for people to be given one of these things
+
+116
+00:06:34,000 --> 00:06:37,000
+that shows the company name, your name, and your title.
+
+117
+00:06:37,000 --> 00:06:42,000
+Sometimes they're embedded with what's called an RFID chip or radio frequency ID chips.
+
+118
+00:06:42,000 --> 00:06:47,000
+So what these are badges are going to be used to identify personnel and will contain some kind of magnetic
+
+119
+00:06:47,000 --> 00:06:47,000
+strip.
+
+120
+00:06:47,000 --> 00:06:53,000
+A lot of times these badges are going to be used to enter certain rooms that only these people should
+
+121
+00:06:53,000 --> 00:06:54,000
+have access to.
+
+122
+00:06:55,000 --> 00:06:56,000
+Leiden.
+
+123
+00:06:57,000 --> 00:07:02,000
+Cameras can detect, uh, if it's dark or if it's completely black.
+
+124
+00:07:02,000 --> 00:07:05,000
+You want to make sure that you have adequate lighting.
+
+125
+00:07:05,000 --> 00:07:10,000
+It's going to be important for security, especially in outdoor areas, because when the sun goes down,
+
+126
+00:07:10,000 --> 00:07:13,000
+you're not going to be able to see the entire perimeter.
+
+127
+00:07:13,000 --> 00:07:20,000
+So make sure the perimeter is well lit and enhances visibility, acting as a deterrent to trespassers,
+
+128
+00:07:20,000 --> 00:07:22,000
+aiding in the effectiveness of video surveillance.
+
+129
+00:07:22,000 --> 00:07:27,000
+You see, if it goes dark and the area is completely black, people can just dressed in black and run
+
+130
+00:07:27,000 --> 00:07:32,000
+through the space, run through the yard, run through the big open ground.
+
+131
+00:07:32,000 --> 00:07:40,000
+That's because run through the big open ground, because it's relatively easy for them to go through,
+
+132
+00:07:40,000 --> 00:07:42,000
+and the camera can't detect them because it's all black.
+
+133
+00:07:42,000 --> 00:07:46,000
+Remember, the camera needs light sensors.
+
+134
+00:07:46,000 --> 00:07:50,000
+Now you're going to have a variety of motion detectors.
+
+135
+00:07:50,000 --> 00:07:56,000
+Now these kinds of motion detectors is going to be able to detect motion in around your ground.
+
+136
+00:07:56,000 --> 00:07:57,000
+There's a few different ones.
+
+137
+00:07:57,000 --> 00:07:59,000
+The first one is going to be infrared sensors.
+
+138
+00:07:59,000 --> 00:08:03,000
+These are going to detect heat often used in an intrusion detection system.
+
+139
+00:08:03,000 --> 00:08:05,000
+These are really good because basically.
+
+140
+00:08:06,000 --> 00:08:12,000
+These are going to be really used to detect if there's heat in the space and if there's movement within
+
+141
+00:08:12,000 --> 00:08:13,000
+that space of that heat.
+
+142
+00:08:13,000 --> 00:08:15,000
+Heat signals the infrared sensors.
+
+143
+00:08:15,000 --> 00:08:17,000
+The problem is they're not going to be able to do a white space.
+
+144
+00:08:17,000 --> 00:08:19,000
+The other one you have is a pressure sensor.
+
+145
+00:08:19,000 --> 00:08:22,000
+These detect changes in pressure like weight.
+
+146
+00:08:22,000 --> 00:08:25,000
+These are these are going to put on things like secure flooring or windows.
+
+147
+00:08:25,000 --> 00:08:30,000
+So if anybody like for example steps on the flooring, it's going to know the weight has changed or
+
+148
+00:08:30,000 --> 00:08:32,000
+the pressure has changed and it's going to set off an alarm.
+
+149
+00:08:32,000 --> 00:08:36,000
+Now, if you have something like a big perimeter or a big ground that you want to secure, you're going
+
+150
+00:08:36,000 --> 00:08:37,000
+to use what's called microwave sensors.
+
+151
+00:08:37,000 --> 00:08:40,000
+These are going to be able to detect movement in a much larger area.
+
+152
+00:08:41,000 --> 00:08:46,000
+Now, the other one you have, and some of the later technology is going to be that ultrasonic.
+
+153
+00:08:46,000 --> 00:08:50,000
+These emit ultrasonic wave and measure the reflection off the objects.
+
+154
+00:08:50,000 --> 00:08:55,000
+These are going to basically use in a lot of different motion detection systems that we have out there.
+
+155
+00:08:56,000 --> 00:08:56,000
+Okay.
+
+156
+00:08:56,000 --> 00:08:59,000
+These are going to be some of the things here that you might see on your exam.
+
+157
+00:08:59,000 --> 00:09:04,000
+When it comes to physical security, the best thing is make sure you understand them, understand what
+
+158
+00:09:04,000 --> 00:09:05,000
+these things are when you see them.
+
+159
+00:09:05,000 --> 00:09:13,000
+Now keep in mind, guys, don't forget it doesn't matter how good your technical security is, it's
+
+160
+00:09:13,000 --> 00:09:17,000
+going to be rendered ineffective if you don't have good physical security.
+

23 - Physical Security/002 Quick Quiz.html

@@ -0,0 +1,479 @@
+<!DOCTYPE html>
+<html lang="en">
+    <head>
+        <meta charset="UTF-8" />
+        <meta http-equiv="X-UA-Compatible" content="IE=edge" />
+        <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+        <title>Quiz</title>
+        <style>
+            * {
+                font-family: system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Oxygen, Ubuntu, Cantarell,
+                    "Open Sans", "Helvetica Neue", sans-serif;
+                margin: 0;
+                padding: 0;
+                box-sizing: border-box;
+                font-size: 16px;
+            }
+
+            main {
+                padding-top: 48px;
+            }
+
+            :root {
+                --large-device-width: 850px;
+                --primary-color: #0f172a;
+                --secondary-color: #020617;
+                --primary-text-color: #c7d1dd;
+                --secondary-text-color: #061602;
+                --success-background: hsl(159, 82%, 24%);
+                --success-foreground: hsl(164, 86%, 16%);
+                --success: hsl(160, 84%, 39%);
+                --danger: #ef4444;
+                --warning: #f59e0b;
+                --info-background: hsl(218, 81%, 8%);
+                --info-foreground: hsl(217, 91%, 85%);
+                --border-color: #d1d7dc;
+                --check-box-size: 20px;
+                /* control the size */
+                --check-box-color: var(--info-foreground);
+                /* the active color */
+            }
+
+            body {
+                position: relative;
+                background-color: #020617;
+                color: var(--primary-text-color);
+            }
+
+            #score-stats-container {
+                position: fixed;
+                z-index: 10;
+                top: 0;
+                height: 40px;
+                width: 100%;
+                background-color: var(--info-background);
+
+                padding: 0px 16px;
+                color: var(--info-foreground);
+                font-weight: 600;
+                display: flex;
+                align-items: center;
+                justify-content: space-between;
+            }
+
+            #quiz-container {
+                border-radius: 8px;
+                display: flex;
+                gap: 16px;
+                flex-direction: column;
+            }
+
+            input[type="radio"] {
+                height: var(--check-box-size);
+                aspect-ratio: 1;
+                border: calc(var(--check-box-size) / 8) solid #939393;
+                padding: calc(var(--check-box-size) / 8);
+                background: radial-gradient(farthest-side, var(--check-box-color) 94%, #0000) 50%/0 0 no-repeat
+                    content-box;
+                border-radius: 50%;
+                outline-offset: calc(var(--check-box-size) / 10);
+                -webkit-appearance: none;
+                -moz-appearance: none;
+                appearance: none;
+                cursor: pointer;
+                font-size: inherit;
+                transition: 0.3s;
+            }
+
+            input[type="radio"]:checked {
+                border-color: var(--check-box-color);
+                background-size: 100% 100%;
+            }
+
+            input[type="radio"]:disabled {
+                background: linear-gradient(#939393 0 0) 50%/100% 20% no-repeat content-box;
+                opacity: 0.5;
+                cursor: not-allowed;
+            }
+
+            label {
+                display: inline-flex;
+                align-items: center;
+                gap: 10px;
+                cursor: pointer;
+                padding: 4px 6px;
+                border-radius: 4px;
+            }
+
+            @media (max-width: 767px) {
+                input[type="radio"],
+                label {
+                    cursor: default;
+                }
+
+                #quiz-container {
+                    margin-left: 8px;
+                    margin-right: 8px;
+                }
+            }
+
+            /* PC (Desktop devices) */
+            @media (min-width: 768px) {
+                body {
+                    display: flex;
+                    justify-content: center;
+                }
+
+                main {
+                    max-width: var(--large-device-width);
+                }
+
+                #score-stats-container {
+                    max-width: var(--large-device-width);
+                }
+
+                dialog {
+                    max-width: var(--large-device-width);
+                }
+            }
+
+            @media print {
+                input[type="radio"] {
+                    background: none !important;
+                    border-color: #939393 !important;
+                }
+
+                input[type="radio"]:checked {
+                    border-color: #939393 !important;
+                }
+            }
+
+            .question-lable {
+                display: flex;
+                align-items: center;
+                gap: 8px;
+            }
+
+            button {
+                -webkit-tap-highlight-color: transparent;
+                -webkit-touch-callout: none;
+                -webkit-user-select: none;
+                user-select: none;
+                outline: none;
+                position: relative;
+                overflow: hidden;
+                cursor: pointer;
+            }
+
+            .button {
+                background-color: var(--success-background);
+                border: none;
+                color: #f4f5f7;
+                opacity: 0.8;
+                font-size: 18px;
+                flex-grow: 1;
+                padding: 8px 16px;
+                border-radius: 8px;
+            }
+
+            .button:hover {
+                opacity: 1;
+            }
+
+            .explanation-btn {
+                border: none;
+                color: var(--success);
+                background-color: transparent;
+            }
+
+            #submit-button:active::after {
+                background-color: #ef4444;
+            }
+
+            .single-question-container {
+                background-color: var(--primary-color);
+                display: flex;
+                flex-direction: column;
+                gap: 8px;
+                padding: 16px;
+                border-radius: 8px;
+            }
+
+            #modal-content {
+                padding: 16px;
+                line-height: 24px;
+            }
+
+            dialog::backdrop {
+                background: rgba(0, 0, 0, 0.5);
+            }
+
+            dialog {
+                position: fixed;
+                border: 1px solid var(--border-color);
+                background-color: var(--primary-color);
+                color: rgb(240, 241, 248);
+                padding: 16px;
+                border-radius: 8px;
+                width: 80vw;
+                max-height: 80vh;
+                overflow: auto;
+                top: 50%;
+                left: 50%;
+                -webkit-transform: translateX(-50%) translateY(-50%);
+                -moz-transform: translateX(-50%) translateY(-50%);
+                -ms-transform: translateX(-50%) translateY(-50%);
+                transform: translateX(-50%) translateY(-50%);
+            }
+
+            #close-modal-btn {
+                position: absolute;
+                top: 4px;
+                right: 4px;
+                padding: 2px 8px;
+                border-radius: 2px;
+                border: none;
+                background-color: var(--danger);
+            }
+
+            .correct-answer label {
+                border: 2px solid var(--success);
+                width: 100%;
+            }
+
+            .incorrect-answer label {
+                border: 2px solid var(--danger);
+                width: 100%;
+            }
+
+            .options-container {
+                display: flex;
+                flex-direction: column;
+                gap: 4px;
+            }
+
+            #quiz-meta-container {
+                border-radius: 8px;
+                background-color: var(--primary-color);
+                margin-bottom: 12px;
+                padding: 8px;
+            }
+
+            #quiz-title {
+                text-align: center;
+                font-size: 24px;
+                margin-bottom: 8px;
+            }
+
+            #quiz-description {
+                line-height: 1.5;
+                padding: 2px 6px;
+            }
+        </style>
+    </head>
+
+    <body onload="main()">
+        <main>
+            <section id="quiz-meta-container">
+                <h1 id="quiz-title"></h1>
+                <p id="quiz-description"></p>
+            </section>
+            <section id="score-stats-container">
+                <div id="score-card">
+                    Score: <span id="current-score">999</span> of
+                    <span id="pass-percent">999%</span>
+                </div>
+                <div>Correct: <span id="correct-answers">999</span></div>
+                <div>Incorrect: <span id="wrong-answers">999</span></div>
+            </section>
+
+            <section id="quiz-container"></section>
+
+            <dialog id="modal" class="modal-container">
+                <div id="modal-content">
+                    <p id="modal-text"></p>
+                </div>
+            </dialog>
+        </main>
+
+        <script>
+            const quizData = {"quiz_id": 6180104, "quiz_description": null, "quiz_title": "Quick Quiz", "pass_percent": null, "questions": [{"_class": "assessment", "id": 74728190, "assessment_type": "multiple-choice", "prompt": {"question": "<p>To monitor activities at all times, especially in low-light conditions, which security feature should a business install?</p>", "relatedLectureIds": "", "feedbacks": ["", "", "Video surveillance is the most comprehensive option for monitoring activities, and it often includes capabilities for low-light conditions. Lighting improves visibility but does not record or monitor. Access badges control access but do not monitor wide areas. Infrared sensors detect heat and movement but do not provide visual monitoring.", ""], "answers": ["<p>Lighting</p>", "<p>Access badge</p>", "<p>Video surveillance</p>", "<p>Infrared sensors</p>"]}, "correct_response": ["c"], "section": "", "question_plain": "To monitor activities at all times, especially in low-light conditions, which security feature should a business install?", "related_lectures": []}, {"_class": "assessment", "id": 74728198, "assessment_type": "multiple-choice", "prompt": {"question": "<p>In a museum, which security feature is most effective for protecting exhibits from touch or close proximity by visitors?</p>", "relatedLectureIds": "", "feedbacks": ["", "", "Infrared sensors can be set up around exhibits to detect and alert staff if visitors get too close, making them ideal for protecting exhibits. Pressure sensors are more for detecting weight changes, not proximity. Security guards provide general surveillance but can't monitor all exhibits simultaneously. Access badges control access but don't protect specific items.", ""], "answers": ["<p>Pressure sensors</p>", "<p>Security guard</p>", "<p>Infrared sensors</p>", "<p>Access badge</p>"]}, "correct_response": ["c"], "section": "", "question_plain": "In a museum, which security feature is most effective for protecting exhibits from touch or close proximity by visitors?", "related_lectures": []}, {"_class": "assessment", "id": 74728200, "assessment_type": "multiple-choice", "prompt": {"question": "<p>For a high-security data center, which of the following would most effectively control access to server rooms?</p>", "relatedLectureIds": "", "feedbacks": ["", "An access badge system can specifically control and monitor individual access to sensitive areas like server rooms in a data center. Bollards and fencing are more suited to external security. Ultrasonic sensors detect presence but don't control access.", "", ""], "answers": ["<p>Bollards</p>", "<p>Access badge system</p>", "<p>Fencing</p>", "<p>Ultrasonic sensors</p>"]}, "correct_response": ["b"], "section": "", "question_plain": "For a high-security data center, which of the following would most effectively control access to server rooms?", "related_lectures": []}]};
+            let correct = new Set();
+            let incorrect = new Set();
+            let totalNumberOfQuestions = 0;
+            const quizTitle = quizData.quiz_title;
+            const quizDescription = quizData.quiz_description;
+            const questionData = quizData.questions;
+            const passPercent = quizData.pass_percent;
+            const modalTextElement = document.getElementById("modal-text");
+            const quizContainerElement = document.getElementById("quiz-container");
+
+            const dialog = document.querySelector("dialog");
+            const showButton = document.getElementById("view-explanatin");
+            const closeButton = document.getElementById("close-modal-btn");
+            const quizTitleElement = document.getElementById("quiz-title");
+            const quizDescriptionElement = document.getElementById("quiz-description");
+
+            function main() {
+                // update quiz meta data
+                document.title = quizTitle;
+                quizTitleElement.innerHTML = quizTitle;
+                quizDescriptionElement.innerHTML = quizDescription;
+
+                const passPercentElement = document.getElementById("pass-percent");
+                passPercentElement.innerHTML = passPercent + "%";
+                totalNumberOfQuestions = questionData.length;
+                // shuffle the questionData to randomize the order of the questions
+                for (let i = questionData.length - 1; i > 0; i--) {
+                    const j = Math.floor(Math.random() * (i + 1));
+                    [questionData[i], questionData[j]] = [questionData[j], questionData[i]];
+                }
+
+                let formattedQuestions = questionData.map(formatSingleQuestionData);
+                updateScore();
+                // display the formattedQuestions
+                formattedQuestions.forEach((question, idx) => {
+                    renderSingleQuestion(question, idx + 1);
+                });
+            }
+
+            /**
+             * Formats the question data from the given QuizData object.
+             *
+             * @param {Object} singleQuizData - The singleQuizData object containing prompt and correct_response.
+             * @return {Object} The formatted question object with the following properties:
+             *   - id: The ID of the question.
+             *   - question: The text of the question.
+             *   - answers: The array of answer options.
+             *   - correctAnswer: The text of the correct answer.
+             *   - explanation: The explanation of the correct answer.
+             */
+            function formatSingleQuestionData(singleQuizData = null) {
+                const { prompt, correct_response, id } = singleQuizData;
+                const questionText = prompt.question;
+                const answers = prompt.answers;
+                const correctAnswer = correct_response[0];
+                const correctAnswerText = answers[correctAnswer.toLowerCase().charCodeAt(0) - 97];
+                const questionObj = {
+                    id: id,
+                    question: questionText,
+                    answers: answers,
+                    correctAnswer: correctAnswerText,
+                    explanation: prompt?.explanation || "",
+                };
+                return questionObj;
+            }
+
+            /**
+             * Renders a single question with its options and submit button.
+             *
+             * @param {Object} singleQuestionData - The data of the question to render.
+             * @param {number} rootIndex - The index of the question in the quiz.
+             * @return {void} return nothing.
+             */
+
+            const renderSingleQuestion = (singleQuestionData = {}, rootIndex = 1) => {
+                const { id, explanation, answers, correctAnswer, question } = singleQuestionData;
+                // shuffle the answers to randomize the order of the answers
+                for (let i = answers.length - 1; i > 0; i--) {
+                    const j = Math.floor(Math.random() * (i + 1));
+                    [answers[i], answers[j]] = [answers[j], answers[i]];
+                }
+                const optionsHTML = answers
+                    .map((option, index) => {
+                        const optionId = `${id}_${index}`;
+
+                        return `
+        <div class="question-lable">
+          <input type="radio" id="${optionId}" name="${"answer"}" value="${option}" />
+          <label for="${optionId}">${option}</label>
+        </div>
+      `;
+                    })
+
+                    .join("");
+
+                const container = document.createElement("div");
+                container.innerHTML = `
+        <form data-correct-answer="${correctAnswer}" data-question-id="${id}" class="single-question-container" onsubmit="submitButtonListener(event)">
+          <div style="display: flex;justify-content: space-between;">
+            <p style="font-weight: 600">Question ${rootIndex}:</p>
+            <button type="button" onclick="renderExplanation(event)" id="${`explanation-${id}`}" data-explanation="${explanation}" class="explanation-btn">View Explanation</button>
+          </div>
+          <p style="margin-bottom: 8px;line-height: 1.5">${question}</p>
+          <div class="options-container">
+            ${optionsHTML}
+          </div>
+          <div style="display: flex; gap: 8px;">
+            <button type="submit" id="submit-button" class="button">Submit</button>
+          </div>
+        </form>
+      `;
+                quizContainerElement.appendChild(container);
+            };
+
+            /**
+             * Updates the score on the page based on the number of correct and incorrect answers.
+             *
+             * @return {void} This function does not return a value.
+             */
+            function updateScore() {
+                const currentParcentageElement = document.getElementById("current-score");
+                const correctAnswerElement = document.getElementById("correct-answers");
+                const wrongAnswerElement = document.getElementById("wrong-answers");
+                correctAnswerElement.innerHTML = correct.size;
+                wrongAnswerElement.innerHTML = incorrect.size;
+                const score = Number((correct.size / totalNumberOfQuestions) * 100).toFixed(2);
+                currentParcentageElement.innerHTML = score;
+            }
+
+            /**
+             * Handles the event when the submit button is clicked.
+             *
+             * @param {Event} e - The event object.
+             * @return {void} This function does not return anything.
+             */
+            const submitButtonListener = (e) => {
+                e.preventDefault();
+                const formData = new FormData(e.target);
+                const form = e.target;
+                const selectedOption = e.target.querySelector('input[type="radio"]:checked');
+                if (!selectedOption) {
+                    alert("Please select an answer!");
+                    return;
+                }
+
+                let isCorrect = false;
+                const { answer: userAnswer } = Object.fromEntries(formData.entries());
+                const correctAnswer = e.target.dataset.correctAnswer;
+                const questionId = e.target.dataset.questionId;
+                if (userAnswer == correctAnswer) {
+                    correct.add(questionId);
+                    incorrect.delete(questionId);
+                    isCorrect = true;
+                } else {
+                    incorrect.add(e.target.dataset.questionId);
+                    correct.delete(questionId);
+                }
+                updateScore();
+
+                const resultClass = isCorrect ? "correct-answer" : "incorrect-answer";
+
+                form.querySelectorAll(".question-lable").forEach((label) => {
+                    label.classList.remove("correct-answer", "incorrect-answer");
+                });
+                selectedOption.closest(".question-lable").classList.add(resultClass);
+            };
+
+            function renderExplanation(ev) {
+                modalTextElement.innerHTML = ev.target.dataset?.explanation || "no explanation found";
+                dialog.showModal();
+                dialog.addEventListener("click", (event) => {
+                    if (event.target === dialog) {
+                        dialog.close();
+                    }
+                });
+            }
+        </script>
+    </body>
+</html>

24 - Change Management/001 Change management OB 1.3_en.srt

@@ -0,0 +1,824 @@
+1
+00:00:00,000 --> 00:00:02,000
+As an IT security person.
+
+2
+00:00:02,000 --> 00:00:06,000
+Anytime something breaks within an organization or there's some kind of security incident, the first
+
+3
+00:00:06,000 --> 00:00:09,000
+thing that comes to my mind is what changed?
+
+4
+00:00:09,000 --> 00:00:10,000
+Who changed what?
+
+5
+00:00:10,000 --> 00:00:13,000
+Now I want to point out something to you guys.
+
+6
+00:00:13,000 --> 00:00:17,000
+You could build the greatest and most secure system.
+
+7
+00:00:18,000 --> 00:00:24,000
+Great firewalls, a good configuration on firewalls, just good selection of configuration of switches,
+
+8
+00:00:24,000 --> 00:00:30,000
+routers, access points, anti-malware software, intrusion detection and prevention systems, and so
+
+9
+00:00:30,000 --> 00:00:30,000
+on.
+
+10
+00:00:31,000 --> 00:00:36,000
+And then it just takes somebody to go and do an unauthorized change or change that you didn't authorize
+
+11
+00:00:36,000 --> 00:00:37,000
+or didn't know about.
+
+12
+00:00:37,000 --> 00:00:40,000
+And all your security just goes right down the drain.
+
+13
+00:00:40,000 --> 00:00:44,000
+Maybe because they punch a hole in the firewall, they change the level of authentication that allows
+
+14
+00:00:44,000 --> 00:00:46,000
+easy passwords or something.
+
+15
+00:00:46,000 --> 00:00:50,000
+Change management is critical for IT security.
+
+16
+00:00:50,000 --> 00:00:57,000
+We want to make sure that any changes within the organization is done in a secure way, and it doesn't
+
+17
+00:00:57,000 --> 00:01:01,000
+reduce the security in the organization if it increases it, great.
+
+18
+00:01:01,000 --> 00:01:04,000
+Now you got to keep in mind that change will happen in a company.
+
+19
+00:01:04,000 --> 00:01:08,000
+If a company is around long enough, they're going to change from Windows 10 to Windows 11.
+
+20
+00:01:08,000 --> 00:01:09,000
+They're going to change a router.
+
+21
+00:01:09,000 --> 00:01:10,000
+They're going to change a switch.
+
+22
+00:01:10,000 --> 00:01:12,000
+They're going to change an access point.
+
+23
+00:01:12,000 --> 00:01:14,000
+They're going to change people.
+
+24
+00:01:14,000 --> 00:01:16,000
+Changes will happen.
+
+25
+00:01:16,000 --> 00:01:18,000
+Business processes and procedure changes.
+
+26
+00:01:18,000 --> 00:01:19,000
+So changes will happen.
+
+27
+00:01:20,000 --> 00:01:25,000
+So in this video I want to talk about change management and some of the things we should be expecting
+
+28
+00:01:25,000 --> 00:01:28,000
+when managing changes across the entire company.
+
+29
+00:01:28,000 --> 00:01:35,000
+So in cybersecurity, change management is a structured approach to transitioning individuals, teams
+
+30
+00:01:35,000 --> 00:01:41,000
+and the organization from the current state to a future state or desired future state, while ensuring
+
+31
+00:01:41,000 --> 00:01:45,000
+now keep in mind the security, the confidentiality, integrity and availability of information.
+
+32
+00:01:45,000 --> 00:01:46,000
+So that's important.
+
+33
+00:01:47,000 --> 00:01:48,000
+Remember something.
+
+34
+00:01:49,000 --> 00:01:55,000
+For us to go from where we are right now, our current state to where we want to be a desired state.
+
+35
+00:01:55,000 --> 00:01:57,000
+Something needs to change.
+
+36
+00:01:57,000 --> 00:01:59,000
+I'm £215.
+
+37
+00:01:59,000 --> 00:01:59,000
+All right.
+
+38
+00:01:59,000 --> 00:02:05,000
+The doctor and my wife and everybody keeps telling me, Andrew, you need to be £190.
+
+39
+00:02:05,000 --> 00:02:12,000
+Well, in order for me to go from the current 215 to the desired 190.
+
+40
+00:02:12,000 --> 00:02:15,000
+Well, I got to do what I got to change, right?
+
+41
+00:02:15,000 --> 00:02:19,000
+Maybe I got to give up that eating that Burger King twice a week or that McDonald's a couple of times
+
+42
+00:02:19,000 --> 00:02:20,000
+a week.
+
+43
+00:02:20,000 --> 00:02:21,000
+Maybe I got to give up that couple of beers.
+
+44
+00:02:21,000 --> 00:02:23,000
+In other words, I have to change something.
+
+45
+00:02:23,000 --> 00:02:29,000
+So changes must occur from for an organization to go from a current state to a desired state, your
+
+46
+00:02:29,000 --> 00:02:34,000
+job is going to be to ensure that all the changes that the organization is going to be going through
+
+47
+00:02:34,000 --> 00:02:35,000
+is done in a secure way.
+
+48
+00:02:35,000 --> 00:02:39,000
+Now there are going to be security changes.
+
+49
+00:02:39,000 --> 00:02:41,000
+Now what are security changes?
+
+50
+00:02:41,000 --> 00:02:44,000
+Well, for example, you configure this firewall and it's working all good.
+
+51
+00:02:44,000 --> 00:02:47,000
+Now you want to change a configuration on the firewall.
+
+52
+00:02:47,000 --> 00:02:48,000
+You want to change a rule on it.
+
+53
+00:02:48,000 --> 00:02:50,000
+You want to update a rule.
+
+54
+00:02:50,000 --> 00:02:52,000
+You want to remove a rule on a firewall.
+
+55
+00:02:52,000 --> 00:02:53,000
+Anti-Malware software.
+
+56
+00:02:53,000 --> 00:02:57,000
+Maybe you want to change the anti-malware software or add a new configuration.
+
+57
+00:02:57,000 --> 00:03:01,000
+So let's go through some things that we want to keep in mind when managing changes.
+
+58
+00:03:02,000 --> 00:03:07,000
+Now business process impacting security operation.
+
+59
+00:03:07,000 --> 00:03:09,000
+Now we got to understand something.
+
+60
+00:03:09,000 --> 00:03:14,000
+Business process is what they're going to be doing to produce the deliverables or produce the products
+
+61
+00:03:14,000 --> 00:03:15,000
+and services that they sell.
+
+62
+00:03:15,000 --> 00:03:17,000
+This will have an impact on security.
+
+63
+00:03:17,000 --> 00:03:23,000
+In general, understanding business processes impacting security operations involve knowing how these
+
+64
+00:03:23,000 --> 00:03:28,000
+processes work together to manage changes in a way that minimize risk, and ensuring security and stability
+
+65
+00:03:28,000 --> 00:03:29,000
+of the environment.
+
+66
+00:03:29,000 --> 00:03:33,000
+When you go out and you change something, how is that going to impact?
+
+67
+00:03:34,000 --> 00:03:36,000
+The business processes that's happening.
+
+68
+00:03:36,000 --> 00:03:43,000
+For example, let's say you go and you modify, uh, you implement a new version of windows across everybody's
+
+69
+00:03:43,000 --> 00:03:47,000
+machine, put Windows 11 that you all had, Windows 10, that can have massive disruption to business
+
+70
+00:03:47,000 --> 00:03:51,000
+operation because people may may not know how to use it very well.
+
+71
+00:03:51,000 --> 00:03:56,000
+So you've got to make sure and understand how does these changes impact business operation.
+
+72
+00:03:56,000 --> 00:04:02,000
+Every change management procedure in a business needs to have some kind of an approval process.
+
+73
+00:04:02,000 --> 00:04:04,000
+This is going to be different for every business.
+
+74
+00:04:04,000 --> 00:04:07,000
+Just understand for now that there has to be one.
+
+75
+00:04:07,000 --> 00:04:09,000
+It's a structured approval process.
+
+76
+00:04:10,000 --> 00:04:15,000
+Ensure that any changes, especially those affect on IT systems and security, are reviewed and approved
+
+77
+00:04:15,000 --> 00:04:17,000
+by an authorized personnel.
+
+78
+00:04:17,000 --> 00:04:19,000
+Who is authorized personnel.
+
+79
+00:04:19,000 --> 00:04:26,000
+Depending on the type of change, it may be a lower level IT manager, a higher mid-level IT manager.
+
+80
+00:04:26,000 --> 00:04:30,000
+It may be the CIO that needs to approve of a certain change.
+
+81
+00:04:30,000 --> 00:04:37,000
+For example, a small change to desktop computers may be done by the Helpdesk Help help desk manager,
+
+82
+00:04:37,000 --> 00:04:43,000
+a major change that somebody wants to implement, like, uh, new configuration or firewall may be done
+
+83
+00:04:43,000 --> 00:04:46,000
+by the CISO or the chief information security officer.
+
+84
+00:04:46,000 --> 00:04:52,000
+But change in massive technology, like all the desktops to win for windows uh, 10 to 11 might need
+
+85
+00:04:52,000 --> 00:04:53,000
+the CIO approval.
+
+86
+00:04:53,000 --> 00:04:57,000
+So think of that approval process.
+
+87
+00:04:57,000 --> 00:04:59,000
+It's going to be different for every single organization.
+
+88
+00:04:59,000 --> 00:05:04,000
+This is going to help to mitigate risk associated with unauthorized or poorly planned changes.
+
+89
+00:05:04,000 --> 00:05:06,000
+So you got to have some kind of an approval process.
+
+90
+00:05:06,000 --> 00:05:06,000
+Why?
+
+91
+00:05:06,000 --> 00:05:12,000
+Because then people are going to know, well, I can't implement the change without having the approval.
+
+92
+00:05:12,000 --> 00:05:14,000
+Next thing we want to look at is ownership.
+
+93
+00:05:14,000 --> 00:05:15,000
+Who owns the change?
+
+94
+00:05:16,000 --> 00:05:20,000
+Ownership refers to identify who's responsible for overseeing the change process.
+
+95
+00:05:20,000 --> 00:05:26,000
+So this can go many ways because you can have a person owning the change management process.
+
+96
+00:05:26,000 --> 00:05:32,000
+Or you can have a team doing this, or you can have ownership of the of a specific change itself.
+
+97
+00:05:32,000 --> 00:05:39,000
+When you're when there's ownership of changes, that person or team is going to be responsible for planning,
+
+98
+00:05:39,000 --> 00:05:41,000
+executing and follow up to the change.
+
+99
+00:05:41,000 --> 00:05:48,000
+This ensures accountability and that the appropriate security consideration are integrated into them.
+
+100
+00:05:48,000 --> 00:05:52,000
+The next thing is when we implement the change who's it?
+
+101
+00:05:52,000 --> 00:05:53,000
+Who's this change affected?
+
+102
+00:05:54,000 --> 00:05:59,000
+If you implement a firewall change to allow remote workers, well, then the stakeholders are going
+
+103
+00:05:59,000 --> 00:06:02,000
+to be only people that are working remotely.
+
+104
+00:06:02,000 --> 00:06:06,000
+And of course the IT security department and some infrastructure department.
+
+105
+00:06:06,000 --> 00:06:11,000
+If it's a change like going from Windows 10 to Windows 11, that's a change that's going to impact every
+
+106
+00:06:11,000 --> 00:06:12,000
+single user in the business.
+
+107
+00:06:12,000 --> 00:06:15,000
+These are called stakeholders in change management.
+
+108
+00:06:15,000 --> 00:06:20,000
+Anyone who may be affected or who has influence over the process.
+
+109
+00:06:20,000 --> 00:06:24,000
+So if someone might be affected or is affected, they're going to be considered a stakeholder of the
+
+110
+00:06:24,000 --> 00:06:25,000
+change.
+
+111
+00:06:25,000 --> 00:06:29,000
+This includes IT staff, security teams, management and of course end users.
+
+112
+00:06:29,000 --> 00:06:32,000
+You want to communicate well with them, communicate what the change is.
+
+113
+00:06:32,000 --> 00:06:33,000
+When are they going to get the change?
+
+114
+00:06:33,000 --> 00:06:35,000
+Why is the change needed?
+
+115
+00:06:35,000 --> 00:06:39,000
+So effective communication involves many stakeholders are going to be key for good implementation.
+
+116
+00:06:40,000 --> 00:06:42,000
+I can't emphasize this part enough.
+
+117
+00:06:42,000 --> 00:06:44,000
+You must have good impact analysis.
+
+118
+00:06:45,000 --> 00:06:45,000
+What is that?
+
+119
+00:06:45,000 --> 00:06:54,000
+Well, don't ever implement the change if you don't know how that change is going to affect systems.
+
+120
+00:06:54,000 --> 00:07:00,000
+Way too often there's people implement the change not understanding the impact and it brings system
+
+121
+00:07:00,000 --> 00:07:01,000
+down.
+
+122
+00:07:02,000 --> 00:07:02,000
+Oh man.
+
+123
+00:07:02,000 --> 00:07:03,000
+Why is the server offline?
+
+124
+00:07:03,000 --> 00:07:08,000
+Well Bob put in a change and he didn't realize it would have taken that server off or shut off a particular
+
+125
+00:07:08,000 --> 00:07:09,000
+service.
+
+126
+00:07:09,000 --> 00:07:13,000
+So before implementing the change, it's critical to analyze its potential impact on the organization
+
+127
+00:07:13,000 --> 00:07:14,000
+posture.
+
+128
+00:07:14,000 --> 00:07:20,000
+This includes evaluating the risk and benefits of the change, how it might affect existing security
+
+129
+00:07:20,000 --> 00:07:23,000
+controls, and what new risk it might prevent present to you.
+
+130
+00:07:24,000 --> 00:07:29,000
+Now, understand how it's going to impact and then test your change.
+
+131
+00:07:29,000 --> 00:07:33,000
+Testing changes in a controlled environment for implementation is critical.
+
+132
+00:07:33,000 --> 00:07:39,000
+One of the things I always say, and when something breaks in a change, you're going to say, did you
+
+133
+00:07:39,000 --> 00:07:41,000
+did you test that change?
+
+134
+00:07:41,000 --> 00:07:44,000
+Did you verify that that was going to do what it says?
+
+135
+00:07:44,000 --> 00:07:46,000
+Because that could just brought down the whole system.
+
+136
+00:07:46,000 --> 00:07:49,000
+This helps to identify any unforeseen issues.
+
+137
+00:07:49,000 --> 00:07:56,000
+And then documenting the test, documenting the test results allows the organization to use them to
+
+138
+00:07:56,000 --> 00:08:00,000
+refine if there is any security problems and maybe enhance it in the future.
+
+139
+00:08:01,000 --> 00:08:04,000
+Now you can plan all you want.
+
+140
+00:08:04,000 --> 00:08:09,000
+You can look at the impact you can implement good, uh, good testing environment.
+
+141
+00:08:10,000 --> 00:08:11,000
+And then you go and you implement the change.
+
+142
+00:08:11,000 --> 00:08:14,000
+And before you know it, the old system crashes or the whole place crash.
+
+143
+00:08:16,000 --> 00:08:17,000
+Well, what are you going to do?
+
+144
+00:08:17,000 --> 00:08:19,000
+Well, you got to go back to where you are.
+
+145
+00:08:19,000 --> 00:08:21,000
+This is called a back out plan.
+
+146
+00:08:21,000 --> 00:08:28,000
+It's a contingency plan that can be active if the changes introduces unacceptable risks or causes unforeseen.
+
+147
+00:08:28,000 --> 00:08:33,000
+It outlines the steps to revert the system to their state before the changes minimize the impact.
+
+148
+00:08:33,000 --> 00:08:36,000
+So let's say you send all your users home.
+
+149
+00:08:36,000 --> 00:08:40,000
+You're going to be rolling out a brand new anti-malware software to all the computers.
+
+150
+00:08:40,000 --> 00:08:45,000
+You send them all home, you start rolling it out and you realize.
+
+151
+00:08:46,000 --> 00:08:49,000
+After half the machine's been installed.
+
+152
+00:08:49,000 --> 00:08:50,000
+It's crashing the machine.
+
+153
+00:08:50,000 --> 00:08:51,000
+It's not compatible.
+
+154
+00:08:51,000 --> 00:08:55,000
+You didn't realize some of the Nic cards are not going to function with it.
+
+155
+00:08:55,000 --> 00:08:58,000
+Some of the operating system don't have the right patches and so on to make this thing work.
+
+156
+00:08:58,000 --> 00:09:02,000
+And you only got four hours before the users come back in.
+
+157
+00:09:02,000 --> 00:09:03,000
+But what do you do?
+
+158
+00:09:03,000 --> 00:09:04,000
+Well, the best thing here.
+
+159
+00:09:04,000 --> 00:09:09,000
+Do you have a backup plan, a roll back procedure that we can use to revert the system back quickly
+
+160
+00:09:09,000 --> 00:09:12,000
+to the old one, because we can't have the entire network down.
+
+161
+00:09:12,000 --> 00:09:18,000
+It's always good to have a good backup plan, also known as a roll back plan maintenance window.
+
+162
+00:09:18,000 --> 00:09:22,000
+Well, you got to ask yourself, when are you going to be doing these changes?
+
+163
+00:09:22,000 --> 00:09:25,000
+This is a predetermined period during which changes are implemented.
+
+164
+00:09:25,000 --> 00:09:27,000
+So we have to have a good maintenance window.
+
+165
+00:09:27,000 --> 00:09:34,000
+In other words, we want to be doing it in a time where it is not going to be affecting users.
+
+166
+00:09:34,000 --> 00:09:35,000
+Scheduling changes.
+
+167
+00:09:35,000 --> 00:09:40,000
+The maintenance windows helps in reducing the impact on users, allows for more controlled and secure
+
+168
+00:09:40,000 --> 00:09:43,000
+implementation guys if you want.
+
+169
+00:09:43,000 --> 00:09:47,000
+If you work in it, be prepared to work on weekends.
+
+170
+00:09:47,000 --> 00:09:49,000
+Late, late nights.
+
+171
+00:09:49,000 --> 00:09:54,000
+I'm talking two in the morning, uh, because that's when we roll out many of the changes, especially
+
+172
+00:09:54,000 --> 00:09:59,000
+weekends, Saturday night at 2:00 when all your friends are going to be out at the bar having fun.
+
+173
+00:09:59,000 --> 00:10:03,000
+You're going to be installing some kind of software on a on a desktop.
+
+174
+00:10:03,000 --> 00:10:04,000
+That's your maintenance window.
+
+175
+00:10:04,000 --> 00:10:09,000
+At that time, you have the least amount of users on the network, so the least impact to them.
+
+176
+00:10:10,000 --> 00:10:17,000
+Now keep in mind what SOPs are standard operating procedures are detailed written instructions to achieve
+
+177
+00:10:17,000 --> 00:10:20,000
+something uniformly in the performance of a specific function.
+
+178
+00:10:20,000 --> 00:10:21,000
+So what exactly is this.
+
+179
+00:10:21,000 --> 00:10:24,000
+So company set up standard operating procedures.
+
+180
+00:10:24,000 --> 00:10:30,000
+So standard operating procedure are the SOPs are basically here's a series of steps of how to configure
+
+181
+00:10:30,000 --> 00:10:32,000
+something how to do something.
+
+182
+00:10:32,000 --> 00:10:33,000
+How to produce.
+
+183
+00:10:33,000 --> 00:10:35,000
+So you can have an SOP to configure this firewall.
+
+184
+00:10:35,000 --> 00:10:38,000
+And in it let's say a company has 30 of these things.
+
+185
+00:10:39,000 --> 00:10:40,000
+You have 30 locations.
+
+186
+00:10:40,000 --> 00:10:43,000
+You can have an SOP that says, here's how you take this thing out of the box.
+
+187
+00:10:43,000 --> 00:10:45,000
+Here's how you configure it step by step.
+
+188
+00:10:45,000 --> 00:10:46,000
+Log into the device.
+
+189
+00:10:46,000 --> 00:10:47,000
+Go to this tab.
+
+190
+00:10:47,000 --> 00:10:49,000
+Implement this username configure here.
+
+191
+00:10:49,000 --> 00:10:50,000
+Add this.
+
+192
+00:10:50,000 --> 00:10:51,000
+Update this.
+
+193
+00:10:51,000 --> 00:10:52,000
+Configure this rule.
+
+194
+00:10:52,000 --> 00:10:52,000
+Remove this rule.
+
+195
+00:10:52,000 --> 00:10:53,000
+That's an SOP.
+
+196
+00:10:53,000 --> 00:10:57,000
+Now when you do changes they're going to affect these SOPs.
+
+197
+00:10:57,000 --> 00:11:03,000
+In change management SOPs is kind of a change manager SOPs ensure that changes are implemented consistently
+
+198
+00:11:03,000 --> 00:11:05,000
+and securely and eat into the best practices.
+
+199
+00:11:05,000 --> 00:11:12,000
+Do you have good SOPs for change management or is your changes affecting the SOPs that you already have?
+
+200
+00:11:12,000 --> 00:11:13,000
+You need both.
+
+201
+00:11:13,000 --> 00:11:18,000
+So we're going to have good procedures to manage the changes, and you're going to have and you're going
+
+202
+00:11:18,000 --> 00:11:21,000
+to want to make sure that the changes you implement update existing SOPs.
+
+203
+00:11:23,000 --> 00:11:26,000
+Change management is critical in every organization.
+
+204
+00:11:26,000 --> 00:11:30,000
+Every organization that wants to grow and which one doesn't is going to have to go through some kind
+
+205
+00:11:30,000 --> 00:11:31,000
+of change.
+
+206
+00:11:31,000 --> 00:11:36,000
+And you want to make sure that you allow these changes in a secure manner.
+