Cybersecurity

Chapter learning objectives

1. Describe a cybersecurity risk through assets, threats, vulnerabilities, and business consequences.
2. Explain the purposes and limits of identity, access, encryption, monitoring, and organizational controls.
3. Distinguish continuity, recovery, and incident-response responsibilities.
4. Evaluate control effectiveness using tests, evidence, and business recovery objectives.

Goals for this part

• Explain Assets and Vulnerabilities.
• Explain Attack Patterns.
• Explain Human, Organizational, and Business Risk.

Assets and Vulnerabilities

An asset is something valuable to the organization, including information, services, equipment, knowledge, and relationships. A threat is a circumstance or actor that could cause harm. A vulnerability is a weakness that could contribute to that harm. Risk considers the possibility of an adverse event and its consequences in context.

Assets and Vulnerabilities

A customer database is an asset. Stolen account credentials can create an opportunity for unauthorized access. Excessive permissions can increase the consequences. The risk is not adequately described by naming a piece of malicious software; it requires explaining what can happen to the organization and affected people.

Assets and Vulnerabilities

The familiar security objectives are confidentiality, protecting against inappropriate disclosure; integrity, protecting information and processes from inappropriate alteration; and availability, supporting timely authorized use. A service interruption primarily affects availability, but the same incident can also create uncertainty about integrity and confidentiality.

Attack Patterns

Phishing attempts to induce a person to disclose information or take an action through a deceptive message or interaction. Malware is software designed to perform harmful or unauthorized activity. Ransomware commonly involves disrupting access to systems or data and demanding payment; some incidents also involve data theft.

Attack Patterns

Managers should avoid assuming that the visible symptom describes everything that occurred.

Attack Patterns

Attacks often exploit a chain of opportunities rather than one isolated flaw. A deceptive message may lead to a compromised account, which may have broader permissions than needed. Poor monitoring can delay detection, while weak recovery arrangements increase the disruption.

Attack Patterns: comparison

Attack Patterns

The sequence is an analytical example. Real incidents require evidence rather than assumptions based on one pattern.

Human, Organizational, and Business Risk

Security is shaped by workload, authority, incentives, and dependencies as well as technical controls. Shared accounts may seem convenient during busy periods but make it difficult to establish who acted. A purchasing process that accepts urgent payment changes without independent verification can expose the business even when its software is functioning correctly.

Human, Organizational, and Business Risk

A risk register records the scenario, affected asset or process, possible consequences, existing controls, owner, and proposed response. It helps managers compare risks in business terms. A short interruption to a nonessential archive and an interruption to dispatch during a delivery window can have very different consequences.

Human, Organizational, and Business Risk

Prioritization should consider severity, likelihood, uncertainty, and feasible responses. Numerical ratings can organize discussion, but multiplying arbitrary labels does not create a precise probability. NIST's Cybersecurity Framework 2.0 emphasizes governance and risk outcomes across the organization. Managers need to understand and assign the business risk, rather than leaving every security decision to the technology team.

Goals for this part

• Explain Identity and Access.
• Explain Encryption and Monitoring.
• Explain Policies, Training, and Privacy.

Identity and Access

Authentication checks a claimed identity; authorization determines what that identity may do. A person can be correctly authenticated and still have inappropriate permissions. Least privilege limits access to what a role or task requires. Permissions also need review when responsibilities change.

Identity and Access

Multifactor authentication combines factors from different categories, such as something a person knows and something they possess. It can reduce some account-compromise risks, but effectiveness depends on the method and surrounding process. It does not make every action by an authenticated account legitimate.

Identity and Access

For the wholesaler, named accounts make activity attributable, separate administrative access limits the reach of routine accounts, and timely removal of unnecessary access reduces lingering exposure. A useful access review compares actual permissions with current responsibilities.

Identity and Access

Asking a manager to approve a long list of unfamiliar account names without context can create a completed form with little security value.

Encryption and Monitoring

Encryption transforms readable information into a form that requires an appropriate key to recover. It can protect information in storage or transmission, but it does not determine whether an authorized user should have received it. Key management, access, and the points at which information is decrypted remain important.

Encryption and Monitoring

Monitoring collects and examines evidence about system activity to identify conditions requiring attention. Logs are useful only when the relevant events are captured, retained appropriately, and reviewed by people or mechanisms able to respond. A large volume of alerts can overwhelm a team if priorities and ownership are unclear.

Encryption and Monitoring: comparison

Encryption and Monitoring

The controls address different parts of a risk scenario. Their combination should be evaluated through the outcome it supports, rather than the number of tools installed.

Encryption and Monitoring

A firewall applies rules to network traffic or connections. An intrusion detection capability examines activity for indicators of unauthorized or harmful behavior. These controls support different purposes and require appropriate configuration and follow-up. A permitted connection can still carry an inappropriate action, and a detection alert needs interpretation.

Encryption and Monitoring

The useful question is how each control changes the specific risk scenario and how its operation will be checked.

Policies, Training, and Privacy

A security policy sets expectations and responsibilities. Procedures translate those expectations into actions people can perform. Training helps staff recognize relevant situations and use the procedures. A policy that requires independent verification of a payment change needs an available verification route; an instruction to “be careful” is not enough.

Policies, Training, and Privacy

Training should connect to actual work and support reporting without unnecessary blame. Employees are more likely to provide useful information when the response helps resolve the problem. Managers should also examine whether deadlines or permissions encourage people to bypass the intended process.

Policies, Training, and Privacy

Privacy remains distinct from security. A tightly controlled reporting system may still collect more employee information than its purpose warrants. Control design should consider which information is necessary, who should see it, and how long it is retained. A security objective does not automatically justify unlimited monitoring. The organization needs a proportionate arrangement that protects services and people.

Goals for this part

• Explain Continuity and Recovery.
• Explain Incident Response.
• Explain Auditability and Control Testing.

Continuity and Recovery

Business continuity concerns continuing essential activities during disruption. Disaster recovery focuses on restoring affected technology and information. They are related but distinct: a manual dispatch procedure can support continuity while staff restore the order system.

Continuity and Recovery

A recovery time objective describes a target for how long a service can be unavailable. A recovery point objective describes a target for acceptable data loss expressed in time. These objectives should follow the business process and be tested against feasible arrangements.

Continuity and Recovery

For the wholesaler, losing two hours of orders and losing two hours of an internal archive may have different consequences. A recovery plan should identify dependencies such as identity services, configuration records, network access, and available staff. Restoring a database alone may not restore a usable service.

Continuity and Recovery

Backups also need protection from the incident affecting the live environment and practical restoration tests.

Incident Response

Incident response is the organized handling of a suspected or confirmed adverse security event. The work includes assessing what is known, containing harm, preserving relevant evidence, restoring services, communicating appropriately, and learning from the event. Activities can overlap rather than forming a perfectly linear checklist.

Incident Response

An incident plan needs roles and decision rights before an emergency. Staff should know how to report a concern, who coordinates the response, and who authorizes important changes or external communications. Communications should distinguish confirmed facts from uncertainty and avoid promises unsupported by the investigation.

Incident Response: comparison

Incident Response

The table supports preparation; actual response choices depend on the event and qualified investigation.

Auditability and Control Testing

Auditability is the ability to examine reliable evidence of how a process or control operated. A policy document shows what should happen. A test record, access log, or completed restoration exercise can provide evidence about what actually happened. Neither evidence type should be mistaken for the other.

Auditability and Control Testing

The wholesaler can test whether a former employee's account is disabled, whether a restore produces a usable application, and whether an incident report reaches the right person. A test should record its scope, conditions, result, and unresolved issues. A successful restoration under ideal conditions does not automatically establish performance during a widespread disruption.

Auditability and Control Testing

Review should lead to action. If a recovery test misses its target, managers need to decide whether to improve the arrangement, change the business process, or explicitly reconsider the accepted risk. NIST CSF 2.0 connects governance with identification, protection, detection, response, and recovery. Resilience comes from maintaining those relationships over time.

Reading and assignments

• Chapter reading
• Curated references
• Preview, Case Study, and Homework