W1-2/3 Prioritization (6/27)

  On Wednesday we covered prioritization. What is the most important thing to respond to first? How do we determine what is and what isn't more important? How do we assess the risk being taken? How much risk is too much risk? While some matters may be more general, a lot of prioritization will be based upon what the establishment is doing, who would target them, what resources does the establishment have for defense, etc. The effectiveness of cyber response teams is determined by how appropriate the prioritization of incidents is. Randomly responding and less formalized response protocols/orders (e.g. stacks/LIFO or queues/FIFO) will hinder the potential security capabilities of an establishment. One cannot prioritize for random or abstract orders and expect any type of long-term success. It is best to make decision making and risk taking as formalized as possible. What you do is just as important as what you do first. Basically, some things are more important to attend to right away and other things can wait while you attend to more important tasks. Just because the outcome of something is a major threat does not mean it is a high priority. If that threat is very unlikely to happen then it is not nearly as important as other matters. For example, the sun could be compromised (whether that be going supernova or otherwise) and we would all be in great danger but the chances of that happening anytime soon is extremely unlikely. Inversely this concept remains true. For example, if I'm highly likely to be stung by a sweat bee at the park and I am not allergic then I am not highly concerned about this anemic threat. Unless I am allergic in which case, I am highly susceptible to it. Once it is determined how susceptible something is, how big of threat is an outcome is if it occurs, and how likely an outcome is to occur is compared then priority can be determined, and action can be taken.

   

    The strategy of cyber security is becoming more and more interesting to me. I've always found satisfaction in the nuance of things. The simplicity/complexity of any subject is relative and like a fractal the deeper one looks into something the more they will find. I am really enjoying reading and learning about this material. I learn things better through lecture and it is unfortunate for me that Berea's CSC major is not more lecture based.