Chapter 23 — Security governance, risk and compliance: threat and failure analysis

Lesson map

Lesson 23 published. Map, example, EX067.

flowchart TD
  N0["Learning outcomes"]
  N1["23.1 Threat scenarios"]
  N2["23.2 Failure modes"]
  N3["23.3 Combining views"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX067"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["23.1 Threat scenarios"]
  N2["23.2 Failure modes"]
  N3["23.3 Combining views"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX067"]

[Learning outcomes]
    |
    v
[23.1 Threat scenarios]
    |
    v
[23.2 Failure modes]
    |
    v
[23.3 Combining views]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX067]

Learning outcomes

You will (1) identify threat scenarios for Ardwell; (2) analyse failure modes of governance controls; (3) combine threat and failure views in risk identification.

23.1 Threat scenarios

Nadia builds threat scenarios following the structure of NIST SP 800-30 Rev. 1. A criminal group encrypts office systems and demands payment. An insider in billing alters customer accounts. A vendor's compromised laptop connects to control systems. A card skimming script is injected into the payment portal. Each scenario names a threat source, an event, the vulnerabilities exploited and the impact. Scenarios make risk concrete for owners, who find it easier to judge likelihood and impact for a story than for an abstract category. The compromised vendor laptop scenario connects directly to the remote access gaps she found in chapter 11.

23.2 Failure modes

Controls themselves can fail. Nadia applies failure mode thinking to Ardwell's access review: reviewers may approve everything without checking, the list of accounts may be incomplete, or removals may be approved but never carried out. For each failure mode she asks how it would be detected and what its effect would be. This analysis reveals that nobody checks whether approved removals happen. She proposes a follow-up test comparing approved removals with actual account changes after each review. Comparing approved removals with account changes would catch the most silent of the three failure modes.

23.3 Combining views

Threat analysis asks what could attack Ardwell; failure analysis asks how its defences could quietly stop working. Nadia combines them in the risk register by linking scenarios to the controls they depend on and to those controls' failure modes. A scenario relying on a control with an undetected failure mode is riskier than it looks. Prof. Brenner notes that many real incidents combine an external threat with an internal control failure nobody noticed, so both views are needed. A ransomware scenario relying on backups whose restore has never been tested is a clear example of such hidden risk.

Worked example

Nadia writes four threat scenarios, analyses failure modes of access review and links both views in the register.

Synthetic case. Scenarios are synthetic; SP 800-30 Rev. 1 is real.

Errors and limits

Scenario lists are never complete. Failure analysis takes time.

Exercises

• EX067 — Scenario parts. Which parts does each scenario name?
  Show marking criteria

  Rubric: 3 = threat source, event, vulnerabilities and impact;; 2 = four;; 1 = vague;; 0 = none.
• EX068 — Hidden failure. Which failure mode of access review went unchecked?
  Show marking criteria

  Rubric: 3 = approved removals never carried out;; 2 = follow-up;; 1 = vague;; 0 = none.
• EX069 — Combined risk. Why is a scenario relying on a control with an undetected failure mode riskier?
  Show marking criteria

  Rubric: 3 = the defence may have quietly stopped working;; 2 = hidden failure;; 1 = vague;; 0 = none.

Synthesis

Combining threat scenarios with control failure modes reveals risks that either view alone would miss.

Continue studying — chapter 23 of 50

← Chapter 22 (draft) · Course chapter index · Chapter 24 (draft) →