Chapter 23 — Security architecture and engineering: methods I

Lesson map

Lesson 23 published. Map, example, EX067.

flowchart TD
  N0["Learning outcomes"]
  N1["23.1 A risk assessment method"]
  N2["23.2 Consistent estimates"]
  N3["23.3 Documenting decisions"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX067"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["23.1 A risk assessment method"]
  N2["23.2 Consistent estimates"]
  N3["23.3 Documenting decisions"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX067"]

[Learning outcomes]
    |
    v
[23.1 A risk assessment method]
    |
    v
[23.2 Consistent estimates]
    |
    v
[23.3 Documenting decisions]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX067]

Learning outcomes

You will (1) apply a risk assessment method to a Fernway project; (2) estimate likelihood and impact consistently; (3) document decisions for review.

23.1 A risk assessment method

Fernway plans a click-and-collect service. Lucas runs a risk assessment using the structure in NIST SP 800-30 Rev. 1: identify threat sources and events, vulnerabilities, likelihood, impact and resulting risk. He scales it down for a co-operative, using a one-page template per risk. Threat events include someone collecting another customer's order and staff misusing customer phone numbers. He involves a store manager, because people who run the process know where it can go wrong in ways a diagram never shows. The template fits on a single page so that it gets used.

23.2 Consistent estimates

Lucas defines likelihood and impact scales with examples so different people rate consistently: high likelihood means expected several times a year at Fernway; high impact means loss above a set amount or harm to many members. He asks Hannah and the store manager to rate the same five risks independently, then compares ratings. They differ on two, and discussion reveals the store manager knows of past collection mistakes Hannah had not heard about. Consistent scales help, but discussion of differences is where most information emerges.

23.3 Documenting decisions

For each risk Lucas records the rating, the proposed treatment and the decision maker. Wrong-person collection is treated with a collection code sent by text and checked at the counter. Phone number misuse is treated by masking numbers in the store app after collection. One low risk, a delayed notification email, is accepted. Each decision has a review date. The record allows auditors and future staff to see why choices were made, which matters when people leave and the reasoning would otherwise be lost.

Worked example

Lucas applies an SP 800-30-style assessment to click-and-collect with defined scales, compares independent ratings and records treatment decisions.

Synthetic case. The project and ratings are synthetic; SP 800-30 Rev. 1 is real.

Errors and limits

Qualitative scales hide uncertainty. Small teams may share blind spots despite independent rating.

Exercises

• EX067 — Why a store manager. Why did Lucas involve a store manager?
  Show marking criteria

  Rubric: 3 = people who run the process know where it fails;; 2 = local knowledge;; 1 = vague;; 0 = none.
• EX068 — Rating differences. What did comparing independent ratings reveal?
  Show marking criteria

  Rubric: 3 = past collection mistakes known only to the store manager;; 2 = new information;; 1 = vague;; 0 = none.
• EX069 — Wrong-person treatment. How was wrong-person collection treated?
  Show marking criteria

  Rubric: 3 = a text collection code checked at the counter;; 2 = code;; 1 = vague;; 0 = none.

Synthesis

A scaled-down, documented risk method with clear scales turns a new project's risks into owned decisions.

Continue studying — chapter 23 of 40

← Chapter 22 (draft) · Course chapter index · Chapter 24 (draft) →