OpenCyber Academy
Postgraduate · Chapter 4 · English
Course code: OCA-152Chapter 04: OCA-152-C004

Chapter 4 — Advanced risk and ethics

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 04 published. Map, example, EX016.

flowchart TD
  N0["Learning outcomes"]
  N1["4.1 Customer-centred risk"]
  N2["4.2 Data protection duties"]
  N3["4.3 Ethical tensions"]
  N4["4.4 Disclosure"]
  N5["4.5 Responsible reporting to vendors"]
  N6["4.6 Fairness to staff"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX016"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["4.1 Customer-centred risk"]
  N2["4.2 Data protection duties"]
  N3["4.3 Ethical tensions"]
  N4["4.4 Disclosure"]
  N5["4.5 Responsible reporting to vendors"]
  N6["4.6 Fairness to staff"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX016"]

[Learning outcomes]
    |
    v
[4.1 Customer-centred risk]
    |
    v
[4.2 Data protection duties]
    |
    v
[4.3 Ethical tensions]
    |
    v
[4.4 Disclosure]
    |
    v
[4.5 Responsible reporting to vendors]
    |
    v
[4.6 Fairness to staff]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX016]

Learning outcomes

You will (1) assess risk to customers, not only to the organisation; (2) apply data protection duties to third-party code; (3) handle ethical tensions in vendor relationships; (4) decide disclosure obligations.

4.1 Customer-centred risk

The February incident cost the bank little money, but customers lost control of their location data. Hannah's risk method now rates harm to customers separately from harm to the bank, so a cheap incident with real customer harm is not under-ranked.

The two ratings sit side by side in the risk register, and either one can raise an item's priority. For February, harm to the bank was rated low, while harm to customers was rated high, because people had not agreed to share where they were.

4.2 Data protection duties

The bank is responsible for data its app collects, including data an SDK sends to a vendor. A lawful basis and transparency are needed; the privacy notice did not mention location. Data protection impact assessments are now required for SDKs that process personal data.

The privacy team leads these assessments, with Hannah's team supplying what the diff harness observes about each SDK's data. The privacy notice was corrected, and the analytics SDK's location collection was switched off until the vendor changed its default.

4.3 Ethical tensions

The SDK vendor's sales team argued that location helped "improve analytics". Hannah's view: collecting data customers were not told about breaks trust regardless of usefulness. The bank asks the vendor to disable location collection by default for all its customers, not just Northbridge.

Hannah writes her reasoning into the vendor review so the position does not depend on her being in the room. The bank also decides that usefulness alone will not justify any new data field an SDK starts sending.

4.4 Disclosure

The bank told the regulator and published a short notice for customers explaining what happened, what data was involved and what the bank did. Hannah argues that clear, early disclosure protects trust better than silence.

The notice was written in plain language and reviewed by legal and the privacy team before publication. It avoided blaming the vendor and stated the bank's own responsibility for what its app collects. Customers who asked further questions were answered through the normal complaints route.

4.5 Responsible reporting to vendors

The change in data collection was not a vulnerability but a behaviour change; still, the bank reports it to the vendor's security contact so other customers can be told.

The report sets out what changed between versions, how the bank observed it in testing, and which customers' data was affected. It does not accuse the vendor of bad intent, since the change may have been a default the vendor had not thought through. Hannah asks the vendor to confirm in writing how other customers will be informed, and records the reply in the vendor file.

4.6 Fairness to staff

The engineer who merged the dependency refresh followed the process as it was; the analysis focuses on the missing review step, not on blame.

The incident review records that the automated refresh had no step where anyone could have seen the new data collection. Naming the engineer would have taught other teams to avoid merging refreshes, slowing security updates, so the fix targets the process. Hannah thanks the engineer for helping reconstruct the timeline, which made the review faster and more accurate. The finding is phrased as a missing control, with the action owned by Hannah's team.

Worked example

The vendor releases a new version with location off by default and a changelog entry describing data-collection changes. Northbridge adds a contract clause requiring advance notice of any change to data collected by SDKs.

Synthetic case. The vendor exchange and outcomes are synthetic.

Errors and limits

Ethical judgements can conflict with commercial pressure; record reasoning and escalate disagreements.

Exercises

Synthesis

Weigh customer harm, meet data duties, disclose honestly and fix processes, not people.

Continue studying — chapter 04 of 12

← Chapter 03 (draft) · Course chapter index · Chapter 05 (draft) →

Worked answers

EX016. So incidents that cost the bank little but harm customers are not under-ranked.

EX017. It did not mention location data.

EX018. To disable location collection by default for all its customers.

EX019. Advance notice of any change to data collected by SDKs.

EX020. Because they followed the process; the gap was the missing review step.