Chapter 23 — Data governance: threat and failure analysis
Lesson map
Lesson 23 published. Map, example, EX067.
flowchart TD
N0["Learning outcomes"]
N1["23.1 Failure modes"]
N2["23.2 Threats"]
N3["23.3 Ranking"]
N4["23.4 Mitigations"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX067"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["23.1 Failure modes"]
N2["23.2 Threats"]
N3["23.3 Ranking"]
N4["23.4 Mitigations"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX067"]
[Learning outcomes]
|
v
[23.1 Failure modes]
|
v
[23.2 Threats]
|
v
[23.3 Ranking]
|
v
[23.4 Mitigations]
|
v
[Worked example] --> [Exercise EX067]
Learning outcomes
You will (1) analyse threats and failure modes affecting governed data; (2) rank them by likelihood and impact; (3) map mitigations to owners.
23.1 Failure modes
Kofi runs a failure mode and effects analysis on the leakage chain. For each node he asks how it could fail, what effect the failure would have on the figure and how it would be detected. Failure modes include a stuck flow sensor reporting constant values, a billing extract missing a district, a tariff change applied late and a manual read keyed with a decimal error. Each failure mode receives severity, occurrence and detection scores agreed with the owners concerned. Scores are recorded.
23.2 Threats
He adds deliberate threats using NIST SP 800-30r1 as a guide: an insider altering readings to hide a billing error, malware on the control network corrupting sensor data and a vendor employee changing a file format without notice. For each threat he identifies the source, the vulnerability exploited and the impact on the leakage figure. He notes that threats and accidental failures often produce the same symptoms, so detection controls should serve both purposes rather than being designed separately. Each threat has an owner.
23.3 Ranking
Kofi ranks the combined list. A stuck flow sensor ranks highest, because it is likely, affects supplied volume directly and could go unnoticed for weeks. Missing billing districts rank second. The insider threat ranks lower in likelihood but high in impact. He shows the ranking to owners, who agree that detection improvements for sensors should be the first investment, since earlier detection reduces the impact of every downstream failure in the chain. The ranking is reviewed again after the first detectors have operated for three months.
23.4 Mitigations
Each high-ranked item receives a mitigation and an owner: a flat-line detector on flow sensors owned by network operations, a district completeness check owned by billing and tamper-evident logs for reading edits owned by metering. Kofi records residual risk after each mitigation. Prof. Varga notes that a ranked analysis with named owners is what turns a list of worries into a governance plan, because it says who does what first and how anyone will know whether it worked. Residual risks are reported quarterly.
Worked example
Kofi analyses failure modes and threats on the leakage chain, ranks a stuck flow sensor highest, and assigns detectors, completeness checks and tamper-evident logs to owners.
Synthetic case. The analysis is synthetic; NIST SP 800-30r1 is real.
Errors and limits
Scores agreed by one person are guesses; agree them with owners.
Exercises
- EX067 — Top risk. Which failure ranked highest? Rubric: 3 = a stuck flow sensor;; 2 = partly correct;; 1 = other;; 0 = none.
- EX068 — Shared symptoms. Why should detection serve threats and failures? Rubric: 3 = they often produce the same symptoms;; 2 = partly correct;; 1 = vague;; 0 = none.
- EX069 — Sensor mitigation. What mitigation targets stuck sensors? Rubric: 3 = a flat-line detector owned by network operations;; 2 = partly correct;; 1 = vague;; 0 = none.
Continue studying — lesson 23 (chapter 23 of 50)
← Chapter 22 · Course chapter index · Chapter 24 →
Continue to the next authored lesson.