Chapter 13 — Security architecture and engineering: risk scenarios
Lesson map
Lesson 13 published. Map, example, EX037.
flowchart TD
N0["Learning outcomes"]
N1["13.1 Writing scenarios"]
N2["13.2 Rating consistently"]
N3["13.3 Choosing treatments"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX037"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["13.1 Writing scenarios"]
N2["13.2 Rating consistently"]
N3["13.3 Choosing treatments"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX037"]
[Learning outcomes]
|
v
[13.1 Writing scenarios]
|
v
[13.2 Rating consistently]
|
v
[13.3 Choosing treatments]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX037]
Learning outcomes
You will (1) write concrete risk scenarios; (2) rate them consistently; (3) choose treatments.
13.1 Writing scenarios
Tomás turns his findings into scenarios: a fake manifest redirects high-value parcels; ransomware encrypts the route-planning virtual machine during peak; a lost handheld exposes recipient details; the conveyor vendor's support account is misused. Each scenario names a threat, a weakness, an asset and a consequence. Concrete scenarios are easier for managers to judge than abstract risk statements, because they can picture the event and recognise it from their own experience. He keeps each scenario to two or three sentences and avoids technical jargon, so that the operations manager and finance staff can rate them without needing an explanation from IT.
13.2 Rating consistently
Tomás uses a simple three-level scale for likelihood and impact, with examples for each level, following the structure in NIST SP 800-30 Rev. 1. He asks Sam and the operations manager to rate independently. They agree on three scenarios but differ on the lost handheld: the operations manager rates it high likelihood because handhelds go missing every month. That local knowledge changes the rating. Comparing independent ratings brings hidden knowledge into the open and makes the final ratings more defensible. The agreed ratings are recorded with the date of the discussion.
13.3 Choosing treatments
For each scenario, the group chooses a treatment. The fake manifest is reduced by the upload portal and validation. Ransomware is reduced by offline backups and tested restores of the route-planning machine. The lost handheld is reduced by remote wipe and minimised data on screens. Vendor misuse is reduced by time-limited access approved per session. Each treatment has an owner and a date. One low-rated scenario, a printer outage, is accepted because spare printers are kept at each depot. The treatment list is filed with the scenarios for the next review.
Worked example
Tomás writes four concrete scenarios, compares independent ratings using SP 800-30-style scales and records treatments with owners.
Synthetic case. Scenarios and ratings are synthetic; SP 800-30 Rev. 1 is real.
Errors and limits
Three-level scales are coarse. Scenario lists miss surprises.
Exercises
- EX037 — Scenario parts. What four parts does each scenario name? Rubric: 3 = threat, weakness, asset and consequence;; 2 = three;; 1 = vague;; 0 = none.
- EX038 — Rating difference. Why did the operations manager rate the lost handheld higher? Rubric: 3 = handhelds go missing every month;; 2 = local knowledge;; 1 = vague;; 0 = none.
- EX039 — Accepted risk. Which scenario was accepted and why? Rubric: 3 = printer outage; spare printers at each depot;; 2 = printer;; 1 = ransomware;; 0 = none.
Synthesis
Concrete scenarios, independent ratings and owned treatments make risk management practical.
Continue studying — chapter 13 of 30
← Chapter 12 (draft) · Course chapter index · Chapter 14 (draft) →