In this lesson, we will learn about Modeling
with an Existing System.
Modeling with an existing IT system evaluates
potential threats and vulnerabilities
specific to the current organizational environment
to determine what can be exploited
and what security controls are necessary
to mitigate vulnerabilities.
This process starts with identifying threats
that are particularly relevant to the existing system's
architecture and operations.
Then, based on this assessment,
an organization can select appropriate mitigating controls.
Mitigating controls may include multifactor authentication,
or MFA, to protect against unauthorized access,
deploying encryption to safeguard sensitive data,
or setting up intrusion detection systems to monitor
for suspicious activity.
Let's learn more about modeling threats
with an existing IT system in place.
When evaluating threats to an organization
with an existing IT system, it's essential
to first understand how the current architecture
and operations function.
Every system has unique characteristics, from the software
it uses to the way its hardware is configured.
For instance, a company running a web-based platform
might have a different risk profile
than one relying on internal applications.
So, by mapping out architecture and operations,
as well as how components interact, organizations
can identify potential vulnerabilities.
This process reveals where a system might be weak
and allows one to focus on security efforts
in the right places.
One key step in this process is identifying which threats
are particularly relevant to the existing IT system.
For example, if the system relies heavily on databases,
then threats like structured query language
or SQL injection attacks are a significant concern.
In contrast, a system that interacts frequently
with external users, such as an e-commerce website,
might be more susceptible to cross site scripting
or a distributed denial of service attacks.
So understanding the architecture helps an organization
pinpoint the types of attacks
that could target the most vulnerable areas
of the IT system.
Next, with threats identified,
the organization can begin thinking about the most effective
controls to mitigate those threats.
Mitigating controls are actions
or technologies designed to reduce the risk
of a security breach.
For example, multifactor authentication protects against
unauthorized access by requiring users to provide
two or more forms of authentication
before being granted access to the system.
So, MFA can help secure sensitive systems,
especially if employees are accessing the network remotely.
Another effective mitigating control is encryption,
which protects sensitive data from being accessed
or read by unauthorized individuals.
For example, if an organization handles customer payment
information, encrypting that data, both when it's stored
and when it's being transmitted,
can prevent it from being stolen.
Even if a hacker gains access to the system
in this way, encryption ensures that even if the data
is compromised, it is unusable without the correct
decryption keys.
Next, in cases where legacy systems are still in use,
additional mitigating controls may be necessary
due to the older supporting architecture.
For instance, legacy systems often lack modern security
features, making them vulnerable to attacks
such as unpatched software vulnerabilities,
and weak authentication mechanisms.
In this scenario, an organization might deploy
multi-factor authentication to strengthen access control
and implement network segmentation
to mitigate the non-availability of patches
for the legacy system.
Additionally, implementing encryption for both data at rest
and data in transit can protect sensitive information
both on and moving through the network.
These measures provide several layers
of defense against attacks targeting outdated systems.
Next, intrusion prevention systems, or IPS,
are another valuable mitigating control
that can work alongside intrusion detection systems, or IDS.
So while intrusion detection systems are focused on
monitoring and alerting on suspicious activity,
an intrusion prevention system goes a step further
by actively blocking or preventing malicious activity
once it has been detected.
For example, if an attacker attempts to exploit
a vulnerability in a legacy system,
the intrusion prevention system can identify the malicious
traffic and automatically block it
before it reaches the system.
This proactive approach helps stop threats in real time,
preventing potential breaches.
Now, the key to selecting the right mitigating controls
is understanding the organization's unique risk landscape.
Not all systems face the same types of threats
and different controls will have varying levels
of effectiveness depending upon the environment.
Therefore, regular assessments of the system's architecture
and operations are essential for ensuring
that the correct controls are in place
and up to date with emerging threats.
So remember, when modeling threats
to an existing IT system, it's important
to first understand the current system's architecture
and operations to identify vulnerabilities.
Once threats specific to the system are identified,
appropriate mitigating controls can be chosen.
These controls may include actions
like multi-factor authentication, encryption,
and the placement of intrusion detection systems
to protect against potential risks.
Additionally, legacy systems may require additional
protection due to their outdated security features.
Finally, regular assessments of the IT system help ensure
that controls are up to date and still effective.