Chapter 19 — Security governance, risk and compliance: monitoring

Lesson map

Lesson 19 published. Map, example, EX055.

flowchart TD
  N0["Learning outcomes"]
  N1["19.1 Choosing indicators"]
  N2["19.2 The trend"]
  N3["Lab — Vulnerability indicator trend against a thresh"]
  N4["19.3 Responding"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX055"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["19.1 Choosing indicators"]
  N2["19.2 The trend"]
  N3["Lab — Vulnerability indicator trend against a thresh"]
  N4["19.3 Responding"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX055"]

[Learning outcomes]
    |
    v
[19.1 Choosing indicators]
    |
    v
[19.2 The trend]
    |
    v
[Lab — Vulnerability indicator trend against a thresh]
    |
    v
[19.3 Responding]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX055]

Learning outcomes

You will (1) define key risk indicators; (2) track indicators over time against thresholds; (3) respond to breaches of thresholds.

19.1 Choosing indicators

Priya helps choose key risk indicators that give early warning of rising risk. One is the number of unpatched critical vulnerabilities across Riverton's computers at month end, with a threshold of ten. Others include overdue access reviews and stale evidence items. She learns that good indicators are measurable from existing systems, linked to specific risks and reviewed regularly, so that rising values prompt action before incidents occur. A threshold of ten for critical vulnerabilities, for instance, gives the monthly reviewer a clear point at which to act.

19.2 The trend

The lab shows six months of the vulnerability indicator: six in April, eight in May, twelve in June, fourteen in July, nine in August and seven in September. June and July breach the threshold, with the peak of fourteen in July. Priya investigates and finds that a supplier update for imaging software was delayed, preventing operating system patches on reception computers that share software with imaging devices. The cause lay with a supplier, so the indicator pointed to a contract issue rather than to the IT team's patching.

Lab — Vulnerability indicator trend against a threshold

"""KRI trend: unpatched critical vulnerabilities per month vs threshold 10 (synthetic)."""
months = ["Apr", "May", "Jun", "Jul", "Aug", "Sep"]; vals = [6, 8, 12, 14, 9, 7]
for m, v in zip(months, vals): print(f"{m}: {v}{'  BREACH' if v > 10 else ''}")
print(f"breaches {sum(v > 10 for v in vals)}; peak {max(vals)} in {months[vals.index(max(vals))]}")

Run with python3 lab_trend.py. Verified output:

Apr: 6
May: 8
Jun: 12  BREACH
Jul: 14  BREACH
Aug: 9
Sep: 7
breaches 2; peak 14 in Jul

19.3 Responding

When the threshold was breached, the IT lead should have escalated, but no one was watching the indicator monthly. Priya recommends assigning an owner to review indicators each month and a rule that two consecutive breaches go to the operations manager. She also suggests asking the imaging supplier for update timelines in the contract. She learns that indicators help only if someone watches them and has agreed actions when thresholds are crossed. With monthly review, the June breach of twelve would have been escalated before July's peak of fourteen.

Worked example

Priya tracks a vulnerability indicator with two breaches peaking at fourteen in July, traces them to a supplier delay and sets an escalation rule.

Synthetic case. Indicator values are synthetic.

Errors and limits

Thresholds are judgement calls. Indicators can be gamed.

Exercises

• EX055 — Threshold. What threshold applies to unpatched critical vulnerabilities?
  Show marking criteria

  Rubric: 3 = ten;; 2 = 10;; 1 = vague;; 0 = none.
• EX056 — Breach months. Which months breached the threshold?
  Show marking criteria

  Rubric: 3 = June and July;; 2 = two;; 1 = vague;; 0 = none.
• EX057 — Escalation rule. What escalation rule did Priya recommend?
  Show marking criteria

  Rubric: 3 = two consecutive breaches go to the operations manager;; 2 = rule;; 1 = vague;; 0 = none.

Synthesis

Indicators warn only when owners watch them and agreed actions follow breaches.

Continue studying — chapter 19 of 30

← Chapter 18 (draft) · Course chapter index · Chapter 20 (draft) →