Chapter 8 — Security governance, risk and compliance: failure modes

Lesson map

Lesson 08 published. Map, example, EX029.

flowchart TD
  N0["Learning outcomes"]
  N1["8.1 How controls fail"]
  N2["8.2 Detecting failure"]
  N3["8.3 Register entries"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX029"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["8.1 How controls fail"]
  N2["8.2 Detecting failure"]
  N3["8.3 Register entries"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX029"]

[Learning outcomes]
    |
    v
[8.1 How controls fail]
    |
    v
[8.2 Detecting failure]
    |
    v
[8.3 Register entries]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX029]

Learning outcomes

You will (1) identify how technical controls fail; (2) plan detection for each failure; (3) record failure modes in the risk register.

8.1 How controls fail

Amina learns that controls can fail in many ways. Backups can run but miss files. Updates can be paused and forgotten. Firewall rules can be added and never removed. Accounts can stay active after people leave. Certificates can expire. She writes each as a failure mode: what goes wrong, how it would show and what the impact would be. She learns that thinking about failure in advance makes controls more reliable. For backups, the failure mode reads: the job runs, misses files and the gap shows only during a restore.

8.2 Detecting failure

For each failure mode, Amina asks how Fenwick would notice. Missed files would show only in restore tests. Paused updates would show in compliance reports. Stale firewall rules would show in rule reviews. Active leaver accounts would show in reconciliation. Expiring certificates would show in expiry checks. She learns that some failures are silent until something breaks, so regular checks must be scheduled to find them before customers or attackers do. Missed backup files, for instance, will stay invisible until a restore test, which is why restore tests appear later in her schedule.

8.3 Register entries

Amina records the main failure modes in Fenwick's risk register with owners and detection checks. For example, the certificate expiry failure mode is owned by the IT lead, with a monthly expiry check. She learns that recording failure modes makes them part of governance, so checks are scheduled and reviewed rather than relying on someone remembering. Linking each failure mode to a named check also tells an assessor which evidence to ask for. If a monthly check is skipped, the missing entry shows up when the register is reviewed, before a certificate actually expires.

Worked example

Amina lists five control failure modes, plans detection for each and records them in the register with owners.

Synthetic case. Failure modes are synthetic.

Errors and limits

Lists miss novel failures. Checks may fail too.

Exercises

• EX029 — Backup failure. How would missed backup files be detected?
  Show marking criteria

  Rubric: 3 = restore tests;; 2 = restore;; 1 = vague;; 0 = none.
• EX030 — Silent failures. Why must checks be scheduled?
  Show marking criteria

  Rubric: 3 = some failures are silent until something breaks;; 2 = silent;; 1 = vague;; 0 = none.
• EX031 — Certificate owner. Who owns the certificate expiry failure mode?
  Show marking criteria

  Rubric: 3 = the IT lead;; 2 = IT lead, hedged with another option;; 1 = vague;; 0 = none.
• EX032 — Failure mode parts. What three things does each failure mode describe?
  Show marking criteria

  Rubric: 3 = what goes wrong, how it shows, impact;; 2 = three;; 1 = vague;; 0 = none.

Synthesis

Planning detection for each failure mode keeps controls reliable.

Continue studying — chapter 08 of 18

← Chapter 07 (draft) · Course chapter index · Chapter 09 (draft) →