◇ OpenCyber Academy
Postgraduate · Chapter 4 · English

Chapter 4 — Advanced risk and ethics

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 4 — Advanced risk and ethics

Lesson map

Lesson 04 published. Map, example, EX016.

flowchart TD
  N0["Learning outcomes"]
  N1["4.1 Threat in the risk register"]
  N2["4.2 OSINT at scale"]
  N3["4.3 Collection governance"]
  N4["4.4 Purchasing stolen data"]
  N5["4.5 Pressure"]
  N6["4.6 Ethics review"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX016"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["4.1 Threat in the risk register"]
  N2["4.2 OSINT at scale"]
  N3["4.3 Collection governance"]
  N4["4.4 Purchasing stolen data"]
  N5["4.5 Pressure"]
  N6["4.6 Ethics review"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX016"]

[Learning outcomes]
    |
    v
[4.1 Threat in the risk register]
    |
    v
[4.2 OSINT at scale]
    |
    v
[4.3 Collection governance]
    |
    v
[4.4 Purchasing stolen data]
    |
    v
[4.5 Pressure]
    |
    v
[4.6 Ethics review]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX016]

Learning outcomes

You will (1) integrate threat intelligence into enterprise risk assessment; (2) apply data-protection principles to OSINT at scale; (3) govern ethically sensitive collection; (4) handle conflicts between business pressure and ethics.

4.1 Threat in the risk register

Risk registers often score likelihood by gut feeling. CTI can anchor the likelihood column: observed sector techniques, actors' known interest in logistics, and NLG's exposure. Each likelihood should cite the intelligence and its confidence, and be revisited when intelligence changes. Rafael works with NLG's risk team to rewrite the likelihood entries for ransomware, supplier compromise and customs-platform exploitation. Each now cites FPSC reporting, NLG's incidents and exposure, with a confidence level. When intelligence changes, such as new sector reporting, the entry is reviewed rather than left at its old score.

4.2 OSINT at scale

Monitoring public sources for brand abuse, leaked credentials or exposed NLG data touches personal data. Under the GDPR, NLG needs a lawful basis (often legitimate interests, with a documented balancing test), purpose limitation, minimisation and retention limits. A data-protection impact assessment is wise for systematic monitoring. At NLG, monitoring leak sites and code repositories for exposed credentials could collect employees' and customers' personal data. Rafael writes the balancing test with the privacy officer, limits searches to NLG domains and brands, and sets a retention period for anything collected. The data-protection impact assessment is completed and signed by the privacy officer before monitoring begins.

4.3 Collection governance

A collection policy lists approved sources and methods, prohibited ones (fake personas, purchasing stolen data, accessing closed criminal markets without legal approval), approval routes and audit. Analysts should know before a crisis what they may not do. NLG's policy names the approved sources, such as FPSC, public advisories and a contracted provider for leak-site monitoring, and lists prohibited methods. Approval routes say who can authorise a new method, and the ethics panel handles anything not already listed. When the leak-site claim appeared, the team used the contracted provider, as the policy required, rather than visiting the site from a corporate machine.

4.4 Purchasing stolen data

A vendor offers NLG's leaked customer database "for verification". Paying may fund criminals, may be unlawful and creates a new copy of personal data. The ethical path runs through legal counsel, law enforcement and incident response, not procurement. Rafael's answer follows the collection policy: the offer goes to legal counsel and incident response, and law enforcement is informed. Buying the data would not prove what was taken, since the seller could alter it, and it would put more personal data into NLG's systems. The refusal and its reasons are recorded, so the same offer can be answered quickly if it returns.

4.5 Pressure

Executives under stress may ask for intrusive actions — "find out who the hacker is". Analysts need the policy and the confidence to say no, offering lawful alternatives. When the COO asked Rafael to unmask the sender of an extortion email, he explained that identifying individuals is a police matter and offered a lawful assessment of the extortion group's typical behaviour instead. The policy gave him a clear basis for refusing, and the alternative gave the COO something useful.

Rafael keeps a short list of lawful alternatives ready, so a refusal never leaves an executive empty-handed.

4.6 Ethics review

A small ethics panel — legal, privacy, security leadership — reviews new collection methods once, then approves them for routine use. This avoids both ad hoc risk-taking and paralysis. At NLG, the panel reviewed the contracted leak-site monitoring service before it was used, approving it with conditions on what could be retrieved and stored. After approval, analysts could request retrievals routinely without returning to the panel each time. New methods, such as monitoring closed forums, would need a fresh review.

The panel meets only when a new method is proposed, which at NLG has been a few times a year.

Worked example

After an extortion email, the COO asks Rafael to "unmask" the sender. Rafael explains NLG's policy: CTI will preserve evidence, assess the threat and support law enforcement; identifying individuals is a police matter. He offers a lawful assessment of the extortion group's typical behaviour based on public reporting and FPSC intelligence.

Synthetic case. The email and exchange are invented.

Errors and limits

Law varies by country; this chapter is not legal advice. Involve counsel early.

Exercises

Synthesis

Anchor risk in intelligence, govern OSINT under data-protection law, refuse unlawful collection and offer lawful alternatives.

Continue studying — chapter 04 of 12

← Chapter 03 (draft) · Course chapter index · Chapter 05 (draft) →