A risk, a log and a decision
The logs show that a door to the server room was forced three times this month. Your manager asks: "What should we do?"
You cannot just guess. You look at the facts, pick controls to fit, and check the law. That is the whole skill.
Key words
| Word | What it means |
|---|---|
| Security risk | The chance that a threat harms something that matters, and how bad that harm would be. |
| Security event | Something that happens that could affect security, such as a failed sign-in. |
| Log | A record of events, kept by a system. |
| Preventative control | A safeguard that stops a problem before it happens. |
| Corrective control | A safeguard that limits harm after a problem starts. |
| Compensating control | A safeguard that still protects you if the main control fails. |
| Encryption | Scrambling data so only someone with the right key can read it. |
| Environmental security | Protection from fire, flood and other harm from the surroundings. |
| Data protection policy | A company's written rules on keeping personal data safe and lawful. |
| Personal data | Facts about a real person who can be named from them. |
The cells students fill in are left blank in this preview.
By the end of this lesson
Note
I can review a security risk using evidence, choose preventative, corrective and compensating controls to fit it, and follow the law and company policy.
Starter: what you already know
Have a go
Starter: what you already know
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.
Step 1: review the risk
Gather facts from systems and from people. Look at security events and logs. Ask staff what they have seen.
Facts beat guesses. "The door was forced three times in March, all after 10 pm" is a fact. "Somebody is up to something" is not.
Step 2: choose controls that fit the risk
Pick controls to match the risk. Try to choose one of each kind.
Preventative: stop it happening. Corrective: limit the harm if it does. Compensating: a safety net if the first control fails.
Strong controls cost more. Match the effort to how likely and how harmful the risk is.
Step 3: follow the law and policy
Every control must follow the law and the company's own policies. For example, the Data Protection Act 2018 says personal data must be kept safe. Cameras and logs may hold personal data, so they must follow the data protection policy too.
A control that breaks the law is not a control. It is a new problem.
Check: the three steps
Have a go
Check: the three steps
4 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.