A strong door lock is not enough
A branch has a strong lock on the front door. But the server in the back room has the default password, and nobody has told the staff about fake emails.
Security is only as strong as its weakest area. To find every risk, look at three areas: the building, the systems and the people.
By the end of this lesson
Note
I can find and rank the risks in the physical, software and people areas of a scenario.
Key words
| Word | What it means |
|---|---|
| Risk | something that might go wrong and cause harm |
| Physical risk | a risk to the building, the equipment or the power |
| Software risk | a risk in how programs and devices are set up |
| People risk | a risk that comes from what people do or do not do |
| Malware | a harmful program, such as a virus |
| Phishing | a fake message that tricks you into giving away details |
| Likelihood | how likely it is to happen |
| Impact | how bad it is if it happens |
The cells students fill in are left blank in this preview.
Starter
Have a go
Starter
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.
Three areas to walk through
| Area | Look at | Examples of risks |
|---|---|---|
| Physical | The building, rooms, doors, cables, power and equipment | An unlocked comms room, a cut cable, a power cut, a stolen laptop |
| Software and settings | Programs, devices, accounts and their set-up | No updates, default passwords, open ports, no malware protection, weak Wi-Fi |
| People | What staff, visitors and suppliers do | Clicking a fake email, a weak password, letting a stranger follow you in |
The cells students fill in are left blank in this preview.
Walk the site, the systems and the people
A good list does not come from a guess. Walk through each area in turn.
Walk the site: doors, windows, rooms, cables, power. Walk the systems: each device and each account. Walk the people: who has access, what they know and what they do each day.
For each, write the issue you find.
Worked example: a risk list for the branch
| Risk | Area | Likelihood (1 to 3) | Impact (1 to 3) | Score |
|---|---|---|---|---|
| Phishing email to staff | People | 3 | 3 | 3 x 3 = 9 |
| Unlocked comms room | Physical | 2 | 3 | 2 x 3 = 6 |
| No updates on the server | Software | 2 | 2 | 2 x 2 = 4 |
| Tailgating at the door | People | 2 | 2 | 2 x 2 = 4 |
| Weak guest Wi-Fi password | Software | 3 | 1 | 3 x 1 = 3 |
The cells students fill in are left blank in this preview.
Check
Have a go
Check
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.