Chapter 13 — Cryptography and trust services: risk scenarios
Lesson map
Lesson 13 published. Map, example, EX037.
flowchart TD
N0["Learning outcomes"]
N1["13.1 Writing scenarios"]
N2["13.2 Estimating risk"]
N3["13.3 Treatments and owners"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX037"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["13.1 Writing scenarios"]
N2["13.2 Estimating risk"]
N3["13.3 Treatments and owners"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX037"]
[Learning outcomes]
|
v
[13.1 Writing scenarios]
|
v
[13.2 Estimating risk]
|
v
[13.3 Treatments and owners]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX037]
Learning outcomes
You will (1) write risk scenarios for trust services; (2) estimate likelihood and impact; (3) choose treatments and owners.
13.1 Writing scenarios
Rosa writes scenarios in a consistent form: cause, event, consequence. A contractor laptop with a staff device certificate is stolen, the certificate is used to reach the VPN, and internal systems are exposed. The webhook secret leaks from a developer's notes, forged payment notices are accepted, and permits are issued without payment. The public website certificate expires during a holiday weekend, citizens cannot renew permits and the call centre is overwhelmed. Writing scenarios this way keeps them concrete enough to discuss and estimate.
13.2 Estimating risk
For each scenario Rosa estimates likelihood and impact on a three-level scale, with written reasons. The certificate expiry scenario is likely, given past incidents, with moderate impact. The webhook leak is possible with moderate financial impact. The stolen laptop scenario is possible with high impact because VPN access reaches many systems. She resists precise numbers she cannot justify, but she records evidence for each estimate, such as two expiry incidents last year, so others can challenge them. Where colleagues disagree with an estimate, she records both views rather than forcing consensus, and revisits the question once more data arrives.
13.3 Treatments and owners
Rosa proposes treatments. Certificate expiry: automate renewal and add alerts. Webhook leak: store secrets in the secret store, rotate them twice a year and verify timestamps to limit replay. Stolen laptop: require the person's password and one-time code in addition to the device certificate, and revoke certificates promptly. Each treatment gets an owner and a date. Owen presents the scenarios to the council's risk committee, which accepts the treatments and asks for quarterly progress reports. Rosa schedules the first progress report before the meeting ends, so the committee's acceptance turns into dated commitments rather than goodwill.
Worked example
Rosa writes three cause-event-consequence scenarios, estimates them with evidence and assigns treatments, which the risk committee accepts.
Synthetic case. Scenarios and estimates are invented.
Errors and limits
Scenario lists are never complete; revisit after incidents. Three-level scales hide nuance, so record reasons.
Exercises
- EX037 — Scenario form. What three parts does each scenario have? Rubric: 3 = cause, event, consequence;; 2 = two;; 1 = one;; 0 = none.
- EX038 — Expiry estimate. How was the expiry scenario rated, and on what evidence? Rubric: 3 = likely, moderate impact; two expiry incidents last year;; 2 = rating;; 1 = evidence;; 0 = none.
- EX039 — Webhook treatment. What treatments address the webhook leak scenario? Rubric: 3 = secret store, twice-yearly rotation, timestamp verification against replay;; 2 = two;; 1 = one;; 0 = none.
Synthesis
Concrete scenarios with justified estimates and owned treatments make trust-service risks manageable.
Continue studying — chapter 13 of 30
← Chapter 12 (draft) · Course chapter index · Chapter 14 (draft) →