Chapter 4 — Advanced risk and ethics
Lesson map
Lesson 04 published. Map, example, EX016.
flowchart TD
N0["Learning outcomes"]
N1["4.1 Risk assessment"]
N2["4.2 Monitoring administrators"]
N3["4.3 Accountability and trust"]
N4["4.4 Data protection"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX016"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["4.1 Risk assessment"]
N2["4.2 Monitoring administrators"]
N3["4.3 Accountability and trust"]
N4["4.4 Data protection"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX016"]
[Learning outcomes]
|
v
[4.1 Risk assessment]
|
v
[4.2 Monitoring administrators]
|
v
[4.3 Accountability and trust]
|
v
[4.4 Data protection]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX016]
Learning outcomes
You will (1) assess privileged access risk with evidence; (2) consider ethical issues in monitoring administrators; (3) balance accountability with trust.
4.1 Risk assessment
Marta assesses privileged access risks using likelihood and impact, supported by evidence. A shared night-shift account has high impact, because its actions cannot be traced, and moderate likelihood of misuse, given the written password. Text-code multi-factor on administrator accounts has high impact if bypassed through a fake sign-in page. Permanent rights increase the window in which a stolen session can do harm. She ranks these risks, explains the evidence behind each rating and avoids treating her scores as precise measurements.
4.2 Monitoring administrators
Stronger monitoring of administrators raises ethical questions. Administrators are trusted colleagues, and constant scrutiny can feel like an accusation. Yet their access is powerful, and accountability protects them too: clear records can show they did not cause a problem. Marta proposes monitoring focused on actions, such as elevation outside change windows and changes to security settings, rather than on keystrokes or screen recording of all work. Administrators are told exactly what is monitored and why, and the monitoring policy is agreed with their manager and HR.
4.3 Accountability and trust
Accountability and trust are not opposites. Individual named accounts make every action attributable, which allows trust to be based on evidence rather than assumption. Marta explains to the night-shift administrators that ending the shared account protects them: if something goes wrong at 03:00, the records will show who did what, rather than casting suspicion on everyone who knew the password. Framing controls as protection for honest staff, not suspicion of them, makes adoption smoother and more respectful. Both night administrators agree to the change.
4.4 Data protection
Privileged activity logs are personal data about administrators. Marta applies purpose limitation: logs are used for security and troubleshooting, not for judging productivity. Retention is set at one year, matching investigation needs, and access to the logs is limited to the security lead and auditors, with each access recorded. She documents these decisions in Corran's data protection records. Applying privacy principles to monitoring of administrators shows that security and respect for staff can be designed together. The policy is reviewed each year with HR.
Worked example
Marta ranks the shared night-shift account and text-code administrator authentication highest, and proposes action-focused monitoring agreed with HR and explained to administrators.
Synthetic case. Risks, ratings and policies are synthetic.
Errors and limits
Recording all administrator screens by default damages trust and collects far more personal data than security needs.
Exercises
- EX016 — Shared account impact. Why is the shared night-shift account high impact? Rubric: 3 = actions cannot be traced to a person;; 2 = untraceable;; 1 = cost;; 0 = none.
- EX017 — Monitoring focus. What does Marta's monitoring focus on? Rubric: 3 = actions such as off-window elevation and security setting changes;; 2 = actions;; 1 = keystrokes;; 0 = none.
- EX018 — Protection framing. How does ending the shared account protect honest staff? Rubric: 3 = records show who did what, avoiding suspicion on all;; 2 = attribution;; 1 = vague;; 0 = none.
- EX019 — Log retention. How long are privileged activity logs kept? Rubric: 3 = one year;; 2 = year;; 1 = forever;; 0 = none.
- EX020 — Log access. Who may access privileged activity logs? Rubric: 3 = security lead and auditors, with access recorded;; 2 = limited;; 1 = everyone;; 0 = none.
Synthesis
Evidence-based risk rating and transparent, purpose-limited monitoring balance accountability with trust.
Continue studying — chapter 04 of 12
← Chapter 03 (draft) · Course chapter index · Chapter 05 (draft) →