Two fixes, one budget
A school has money for one fix. Fix A closes a flaw on the website. Fix B closes a flaw on the exam results system.
The website flaw has a higher score. But the exam system matters more to the school. Which do you recommend?
A good recommendation weighs many things.
Key words
| Word | What it means |
|---|---|
| Vulnerability | a weak point that an attacker could use |
| Mitigation | an action that makes the harm smaller |
| Impact | the harm done if the weak point is used |
| Mitigating circumstances | facts that make a problem less serious or explain how it happened |
| Personal data | information about a living person |
| UK GDPR | the UK law on how personal data must be handled |
| ICO | the Information Commissioner's Office, the UK body that checks data rules |
| Scope | how many systems or services a problem reaches |
| Resources | the people, money and technology you have to work with |
The cells students fill in are left blank in this preview.
By the end of this lesson
Note
I can weigh eight factors and recommend a sensible fix for a weak point.
Starter
Have a go
Starter
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.
Factors about the problem itself
1. Risk and impact. What would happen to the business, its daily work and its systems?
2. Mitigating circumstances. Was there a good reason for the flaw? For example, the maker has not yet released a patch.
3. Type and severity. What kind of flaw is it and how bad is it?
4. Scope and priority. How many systems does the flaw reach? The CVE score helps to rank it against other flaws.
Factors about doing the work
5. Cost. What does the fix cost? What does it cost to do nothing?
6. Resources. Do you have the people, the money and the technology?
7. Timeframes. Some rules say how fast you must report and respond. A personal data breach must be reported to the ICO within 72 hours of finding out, if it puts people at risk.
8. Potential responses. What choices are there?
Worked example: the cost of doing nothing
| Item | Pounds |
|---|---|
| Cost of the fix: 2 days of work and a tool | 2000 |
| Cost of a breach: refunds, repair, lost sales | 40000 |
| Saved by fixing: 40000 minus 2000 | 38000 |
| Recommendation | Fix it. Doing nothing costs far more |
The cells students fill in are left blank in this preview.
Check
Have a go
Check
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.