Unit 6: Risk Management, Data Protection and Compliance

I. Orientation: Governing Principles

Security risk management is the disciplined process of identifying threats to information assets, estimating their likelihood and impact, and selecting cost-justified controls to reduce exposure to a level the organisation can accept. It presumes that no system is perfectly secure and that resources are finite, so protection must be prioritised.

• Asset: anything of value needing protection — data, hardware, reputation, personnel.
• Threat: a potential cause of an unwanted incident (malware, insider, flood).
• Vulnerability: a weakness a threat can exploit (unpatched server, weak password policy).
• Risk: the intersection of threat, vulnerability and asset value — commonly Risk = Likelihood × Impact.
• Control (safeguard): a measure that reduces risk by lowering likelihood or impact.
• Residual risk: the risk remaining after controls are applied; must be formally accepted by an owner.
• Risk appetite: the amount of risk leadership is willing to tolerate in pursuit of objectives.

II. Risk Management Processes and Concepts

Identifying, measuring and treating exposure

A. The risk management lifecycle

A repeatable cycle keeps risk visible as systems and threats change.

• Identify: catalogue assets and the threats/vulnerabilities affecting them, producing a risk register.
• Assess: estimate likelihood and impact for each entry.
• Treat: choose a response for each risk.
• Monitor: review controls and re-assess on a schedule or after major change.

B. Qualitative and quantitative assessment

Assessment methods differ in rigour and data demands.

1. Qualitative: ranks risk on ordinal scales (Low/Medium/High) using a probability–impact matrix. Fast, subjective, needs no monetary data.
2. Quantitative: assigns monetary values and computes expected loss.

SLE = AV × EF        # Single Loss Expectancy
ALE = SLE × ARO      # Annualised Loss Expectancy

• AV: asset value in currency.
• EF: exposure factor — fraction of asset lost per incident (0–1).
• ARO: annualised rate of occurrence — expected incidents per year.
• Example: a server worth £50,000 (AV), 40% destroyed by fire (EF=0.4), fire expected once in 10 years (ARO=0.1). SLE = 50,000 × 0.4 = £20,000; ALE = 20,000 × 0.1 = £2,000/yr. A control costing under £2,000/yr is justified.

C. Risk treatment strategies

Each identified risk receives one of four responses.

• Avoid: eliminate the activity causing risk (decommission a vulnerable service).
• Mitigate (reduce): apply controls to lower likelihood or impact (patching, encryption).
• Transfer (share): shift financial impact to a third party (cyber insurance, outsourcing).
• Accept: knowingly retain the residual risk when treatment costs exceed benefit.

D. Key risk metrics

Metrics turn risk into trackable figures for recovery planning.

• RTO (Recovery Time Objective): maximum tolerable downtime before unacceptable harm.
• RPO (Recovery Point Objective): maximum tolerable data loss, measured in time (e.g. 1 hour of transactions).
• MTTR / MTBF: mean time to repair and mean time between failures, used to model availability.
• KRI (Key Risk Indicator): an early-warning metric (e.g. count of overdue patches) signalling rising exposure.

III. Vendor Management Concepts

Governing risk introduced by third parties

A. Purpose and principle

Outsourcing transfers work but not accountability, so suppliers must meet the same security bar as the organisation itself.

• Third-party risk: a breach at a vendor can expose the client's data or supply chain.
• Due diligence: investigating a vendor's security posture before engagement (audit reports, financial health, certifications).

B. Vendor assessment and selection

Formal procurement vehicles define expectations before any contract is signed.

• RFI / RFP / RFQ: requests for information, proposal and quotation used to compare suppliers.
• Right-to-audit clause: contractual permission to inspect or audit the vendor's controls.
• Evidence of compliance: SOC 2 reports, ISO 27001 certificates, penetration-test summaries.

C. Agreements and ongoing monitoring

Contracts codify obligations and the end of the relationship.

• SLA (Service Level Agreement): measurable performance and availability commitments (e.g. 99.9% uptime).
• MOU / MOA: memoranda of understanding/agreement — statements of intent, often non-binding.
• BPA (Business Partnership Agreement): governs a shared venture between parties.
• End-of-life / end-of-service-life: dates after which a product receives no updates, forcing replacement.
• Ongoing monitoring: periodic re-assessment, as a vendor's posture degrades over time.

IV. Audits and Assessments

Verifying that controls exist and work

A. Definition and distinction

An audit confirms compliance against a defined standard; an assessment evaluates security posture more broadly.

• Internal audit: performed by the organisation's own staff for self-check and readiness.
• External audit: performed by an independent party, carrying greater credibility for regulators and customers.
• Attestation: a formal statement that findings are accurate.

B. Penetration testing

A controlled, authorised attack simulates a real adversary to find exploitable weaknesses.

• Known / partially known / unknown environment: tester given full, partial or no prior information (formerly white/grey/black box).
• Rules of engagement: scope, timing and permitted techniques agreed in writing before testing.
• Phases: reconnaissance → scanning → exploitation → persistence → reporting.
• Contrast with vulnerability scanning: automated detection that identifies flaws but does not exploit them.

C. Attestation and compliance reporting

Reports communicate assurance to outside parties.

• Regulatory audit: mandated by law or standard (e.g. PCI DSS annual assessment).
• Gap analysis: compares current state against a target framework to list missing controls.
• Independence: auditors must have no stake in the outcome to keep findings credible.

V. Data Classification and Compliance

Labelling data and meeting legal obligations

A. Data classification

Classification assigns a sensitivity level so protection is proportionate to value and risk.

• Public: disclosure causes no harm (marketing material).
• Internal / private: for employees only; moderate harm if leaked.
• Confidential: serious harm (contracts, customer records).
• Restricted / critical: gravest harm (trade secrets, regulated health data).
• Principle: higher classification demands stronger controls — encryption, access limits, retention rules.

B. Data roles and states

Accountability and protection follow the data through its life.

• Data owner: senior accountable party who sets classification.
• Data controller: decides why and how data is processed.
• Data processor: handles data on the controller's behalf.
• Data custodian/steward: implements and maintains the controls day-to-day.
• States: data at rest (storage), in transit (network), in use (memory) — each needs its own safeguard.

C. Compliance frameworks and obligations

Laws and standards impose mandatory requirements with penalties for failure.

• GDPR: EU regulation governing personal-data processing; fines up to 4% of global annual turnover.
• HIPAA: US health-information privacy and security rules.
• PCI DSS: payment-card industry standard for cardholder data.
• Consequences of non-compliance: fines, sanctions, loss of licence, reputational damage, contractual breach.
• Data retention / sovereignty: rules on how long data is kept and in which jurisdiction it may reside.

D. Privacy-enhancing techniques

These reduce the identifiability of data to limit harm from exposure.

1. Anonymisation: irreversibly strips identifiers so individuals cannot be re-identified.
2. Pseudonymisation / tokenisation: replaces identifiers with reversible substitutes, still regulated as personal data.

VI. Personnel Policies

Managing the human element of security

A. Purpose and principle

Most incidents involve people, so policy governs behaviour across the whole employment lifecycle.

• Acceptable Use Policy (AUP): defines permitted use of systems and data.
• Least privilege: users receive only the access their role requires.

B. Onboarding and job-role controls

Controls begin before employment and bind duties to access.

• Background checks: verify identity, history and trustworthiness before hire.
• NDA (Non-Disclosure Agreement): legally binds the employee to confidentiality.
• Separation of duties: splits a sensitive task so no single person can complete it alone (one requests payment, another approves).
• Job rotation: moving staff between roles to expose fraud and reduce dependence on one person.
• Mandatory vacation: enforced leave during which irregularities may surface.

C. Awareness and ongoing conduct

Training sustains secure behaviour while staff are employed.

• Security awareness training: recurring education on phishing, passwords and reporting.
• Phishing simulations: test and reinforce user vigilance with safe mock attacks.
• Clean desk / clear screen: prevents casual exposure of sensitive material.

D. Offboarding

Terminating access promptly closes the main post-employment risk.

• Access revocation: disable accounts and credentials at the moment of departure, ideally automated via the identity system.
• Asset return: recover laptops, tokens and badges.
• Exit interview: remind the leaver of continuing NDA obligations.
• Principle: a dormant active account is a standing vulnerability, so revocation precedes or coincides with notice.