Chapter 13 — Security governance, risk and compliance: risk scenarios

Lesson map

Lesson 13 published. Map, example, EX037.

flowchart TD
  N0["Learning outcomes"]
  N1["13.1 Writing scenarios"]
  N2["13.2 Causes and consequences"]
  N3["13.3 Choosing scenarios"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX037"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["13.1 Writing scenarios"]
  N2["13.2 Causes and consequences"]
  N3["13.3 Choosing scenarios"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX037"]

[Learning outcomes]
    |
    v
[13.1 Writing scenarios]
    |
    v
[13.2 Causes and consequences]
    |
    v
[13.3 Choosing scenarios]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX037]

Learning outcomes

You will (1) write risk scenarios for Riverton; (2) identify causes and consequences; (3) choose scenarios for detailed analysis.

13.1 Writing scenarios

Priya writes risk scenarios as short stories with a cause, an event and consequences. Ransomware encrypts a clinic's reception computers and spreads to the image archive, stopping treatment for days. A receptionist sends a patient's records to the wrong laboratory. A malicious script on the booking site captures card details. A laptop with unencrypted patient lists is stolen from a car. She learns that scenarios help managers imagine risks concretely and judge them sensibly. The stolen laptop story, for example, points straight to encryption as the control that would change its outcome.

13.2 Causes and consequences

For each scenario Priya lists causes, such as phishing or missing segmentation, and consequences for patients, finances, regulators and reputation. For the ransomware scenario, consequences include cancelled appointments, lost income, notification to the regulator if records were affected and patient complaints. She learns that listing causes points to preventive controls, while listing consequences points to recovery and response planning. In the ransomware scenario, phishing as a cause points to email controls, while cancelled appointments point to recovery planning. For misdirected records, the cause is often a hurried choice of recipient at reception.

13.3 Choosing scenarios

With the operations manager, Priya chooses four scenarios for detailed analysis based on likely impact and management concern: ransomware at a clinic, misdirected patient records, card skimming on the booking site and lost laptops. Other scenarios are recorded for later review. She learns that analysis effort should focus on scenarios that matter most, and that a short, well-chosen list is more useful than a long list nobody analyses. Recording the other scenarios keeps them on the register for the next review rather than discarding them.

Worked example

Priya writes four scenarios with causes and consequences and selects them for detailed analysis.

Synthetic case. Scenarios are synthetic.

Errors and limits

Scenarios reflect imagination limits. Selection involves judgement.

Exercises

• EX037 — Scenario structure. What three parts does each scenario contain?
  Show marking criteria

  Rubric: 3 = cause, event and consequences;; 2 = three;; 1 = vague;; 0 = none.
• EX038 — Causes use. What do listed causes point to?
  Show marking criteria

  Rubric: 3 = preventive controls;; 2 = prevention;; 1 = recovery;; 0 = none.
• EX039 — Short list. Why focus on a short list of scenarios?
  Show marking criteria

  Rubric: 3 = effort should go where it matters most;; 2 = focus;; 1 = vague;; 0 = none.

Synthesis

Concrete scenarios link causes to prevention and consequences to response.

Continue studying — chapter 13 of 30

← Chapter 12 (draft) · Course chapter index · Chapter 14 (draft) →