Cyber risks

1 What cyber risk is

Cyber risk can be defined as any risk of financial loss, disruption or damage to the reputation of an organisation by some sort of failure of its information technology systems.

(The Institute of Risk Management)

Cyber risk can arise from:

• Deliberate breaches of security

• Accidental breaches of security

• Operational causes (such as physical breakdown, wrong data or flawed software being used).

Before we address specific risks and how they might be defended against it is worth looking first briefly at how organisations use computers and the various physical arrangements that IT systems can adopt.

YouTube videoLoad YouTube video

2 How organisations use information technology

2.1 Levels of management, and what each needs

Information technology has to support staff at all levels, but there are quite different information needs at different levels:

Disruption of IT at any level can be devastating for a company. For example, the routine processing of sales orders, whether they are received via the company’s internet site or through the post is part of the operational level. Obviously things could go wrong in either case, but the opportunities for chaos are much greater in the Internet system because once a company is connected to the Internet, the Internet and all its users, many of whom might be malicious, are connected to the company.

As you go up through the hierarchy, into the corporate and strategic level, the information is more likely to deal with the company’s future plans. So if board minutes are held on computer and these become available to outsiders and competitors (through industrial espionage) very serious long-term damage can be inflicted on the company.

Perhaps, the specifications of designs, chemical formulae for pharmaceuticals in clinical trials, databases about suppliers are held in the middle, managerial level. Any leakage of that information (industrial espionage again) can again seriously impact an organisation’s profitability and its chance of survival.

3 Physical arrangements for IT systems

3.1 Networks

Only the very smallest of businesses will have stand-alone computers ie computers not connected to other computers. Even in small businesses employees need to share data and very soon after personal computers were invented networks of computers were introduced.

There are two main types:

• Local area network (LAN): Here the network extends over only a relatively small area, such as an office, a university campus or a hospital. The small area means that these networks use specially installed wiring to connect the machines.

• Wide area networks (WAN): Here the network can extend between several cities and countries. Each office would have its LAN, but that connects to LANs in other offices and countries using commercial, public communications systems. At one time this would have been done by the organisation leasing telephone lines for their private use to transmit data from office to office. However, this is expensive and inflexible and the common system now used is known as a virtual private network (VPN).

3.2 Network layers

Most client-server networks comprise of three tiers:

• The presentation tier: this is what you see on your computer screen: information, boxes in which to input data, buttons to click on, drop-down menus to choose from. This will be on the client machine.

• Application tier: this tier, sometimes known as the logic or business logic tier, is where processing takes place. It can be on the client machine or in the cloud. (see later).

• Data tier: where the data is stored, typically a database. It will normally be on the server machine or in the cloud.

So, if you are posting a supplier’s invoice, you will enter the account number into the presentation tier, the application will access the data tier, fetch the customer name and this will be shown to you in the presentation tier. You will enter the amount and nominal code in the presentation tier, the application tier might split out VAT automatically, then post the amounts to the appropriate files in the data tier.

Security problems can happen at any tier. For example:

• A presentation tier might be hijacked so that it looks like, for example, your bank’s web-page, but it is actually a page mocked up to look official (phishing)

• The application tier might be changed to calculate invoices incorrectly.

• The data tier might be accessed so that confidential data is stolen or records altered.

3.3 Virtual private networks (VPNs)

VPN’s allow data to be transmitted securely over the internet between any two locations. Information will pass over many different circuits and connections but the system gives the impression that you are operating over a dedicated, private communications link: hence the name: virtual private network. For example, an employee working from home or a hotel can access the company system as though being in the office. Because data is being transmitted over public systems it is particularly vulnerable to interception and it is very important that adequate security measures are in place to safeguard the data.

There are three essential steps in the security measures:

1. Access control and authentication – this ensures that unauthorized users do not access the system. Typically this will be accomplished through a log-in procedure.

2. Confidentiality – this ensures that data cannot be intercepted and read by a third party whilst being transmitted. This is achieved using encryption.

3. Data integrity – this ensures that the data has not been altered or distorted whilst in transit. To ensure this, the message could have special check digits added to ensure that the data complies with a mathematical rule.

3.4 Centralised and decentralised (distributed) architectures

Consider an office local area network. There are three main ways in which the data and processing can be arranged: centralised, decentralised (distributed) and hybrid.

In a centralised system a powerful central computer holds the data and carries out the processing, and the machines at each site do very little. In a decentralised (distributed) system each user or site has local processing power and holds data locally, often with a file server for shared data. Most real organisations are a hybrid of the two.

3.5 Cloud computing

This is relatively new approach but one that is growing in popularity. There is only one copy of the software on the server within a web-based interface. Users log into the web system and their processing is then carried out on the server or a ‘cloud’ of servers. It appears to each user that they have a local version of the software, but what they are really seeing is the program operating in the server. As more processing is needed more cloud resources can be used and this gives users great flexibility.

Client machines can be ‘thin-clients’ (ie not powerful) as they do not have to store much data and software nor do they have to carry out much processing. Hardware, software and maintenance costs are greatly reduced, though the system is vulnerable to service disruption.

It can be particularly useful where a company’s processing needs are very volatile. For example, a design or engineering company might need very high computing power only when rendering (ie producing detailed graphics) work. Much of the time processing needs are small. Therefore, instead of having a large computer of its own, the design company’s work is hosted by a cloud-based computer (whose use is shared). That computer will be powerful enough to deal with intensive processing as needed. Also, designers can work at home, for example, on laptops. The relatively low powered laptop provides the interface but the bulk of the processing is done elsewhere.

Obviously there are risks arising from:

• Loss of communications with the cloud machine.

• Communications that are too slow.

• Confidential data is being held on a third party machine and being transmitted over public communications systems.

4 Risks in IT systems

IT poses particular risks to organisations’ internal control and information systems and organisations must try to safeguard their data and IT systems otherwise problems can lead to downtime — operations severely disrupted, or stopped altogether — and subsequently to lost sales, increased costs, incorrect decisions and reputational damage. Some security breaches might leave an organisation open to prosecution.

Risks include:

• Reliance on systems or programs that are inaccurately processing data, processing inaccurate data so that they report inaccurate, misleading results. For example, in 2018 a UK bank, TSB, transferred its customers’ accounts to another computer system run by Sabadell, TSB’s Spanish owner. Many customers then had great difficulty accessing their accounts over the Internet or via ATM machines. In 2012 RBS, another British bank carried out a routine update of its software, but the update had been corrupted. Again, customers could not carry out transactions for up to a week.

• Unauthorised access to data leading to destruction of data, improper changes to data, or inaccurate recording of transactions. In 2018, British Airways and Amazon both suffered data hacks which meant that customers’ details were stolen.

• Particular risks may arise where multiple users access a common database on which everyone in the organisation relies. The data could be incorrectly amended and all users will be affected.

• Web application attacks. When you visit a website, you might simply access a static web-page which, for example, shows the name and address of the company which own the web-site. Alternatively, the web-site might load Java script (a programming language) into your browser and this is capable of carrying out processing. What you then have is a web application. For example, when you enter your credit card details into a site like Amazon, the validity of your card is checked locally because your card number has to comply with certain construction rules. Validity checking is carried out on your machine within your browser running a web application. Web application attacks might therefore try to interfere with the functionality of the web app you are running. For example, whilst checking the validity of your credit card, the altered application might now send details to the hacker.

• Malware is a term that covers all software intentionally designed to cause damage to a client computer, a server, the network or data. Malware includes:

  • Virus: a malicious program that inserts itself into another program and which then spreads by infecting other computers and data files.

  • Worm: can self replicate and which are stand-alone.

  • Trojan: a piece of software that looks harmless but which causes damage or inconvenience when run

  • Ransomware: threatens to publish the victim’s data or which scrambles data until a ransom is paid.

  • Bots: derived from ‘robot’, this is a piece of software that carries out automated processes. For example, emails or posts on social media can be generated to give the appearance of support for particular causes.

  • Spyware. For example, a piece of malware that records you activity on the Internet and sends that information to an unauthorised third party.

  • Denial of service (DOS) attacks. Typically, the overwhelming of internet sites with demands for responses so that legitimate users are denied service.

  • Backdoors. Undocumented ways into a system so that normal log-on, password and security checks are bypassed.

• The possibility of IT personnel gaining access privileges beyond those necessary to perform their assigned duties.

• Human error.

• Physical damage, such as fire or water damage.

• Industrial espionage.

• Fraud. Often easier by computer as it can be easier for the perpetrator to be disguised and small, almost trivial, amounts can be stolen many times so that the total becomes significant. IT fraud generally depends on either changing data or programs. For example, a person could commit a salary fraud either by changing their salary (ie altering data) or changing the salary program to boost net salary when a particular employee is being dealt with (a program fraud).

• Unauthorised changes to data in master files. For example, changing a selling price or a credit limit.

• Unauthorised changes to systems or programs so that they no longer operate correctly and reliably.

• Failure to make necessary changes to systems or programs to keep them up-to-date and in line with legal and business requirements.

• Potential loss of data or inability to access data as required. This could prevent, for example, the processing of internet sales.

5 Cyber security

YouTube videoLoad YouTube video

Cyber security is usually organised around four objectives, and they are worth learning as a set because an organisation that does only the second of them — which is what most organisations did first — has no idea whether it is being attacked:

• Managing security risk

• Protecting against cyber attack

• Detecting cyber security events

• Minimising the impact of cyber security events

The framing above is that of the United Kingdom's National Cyber Security Centre, used here as one published example; equivalent national bodies publish very similar objectives, and the four are worth learning as a sequence rather than as a national scheme. Protection alone is not a cyber security strategy. An organisation that protects but does not detect will learn about its breaches from its customers, its regulator or the press — which is exactly the failure Example 1 in §6 turns on.

5.1 Managing security risk

This is high level and includes considering the organisation’s attitude to risk, identifying and assessing risks, identifying essential services that must be maintained and understanding interdependencies arising from suppliers of hardware and software, and any interactions with sub-contractors.

Earlier we explained the process of risk identification, a risk register and assurance mapping. We also mentioned the severe reputational damage that can occur as a result of unethical behaviour. Digital resources are now so important and significant to many businesses that the risks that potentially arise from poor cyber security are enormous so organisations should have formal procedures in place to regularly:

• Identify potential cyber security risks. For example regularly review access control, stay aware of new threats, employ consultants to try to ‘break into’ the system. Analyse past problems as these will remain problems unless changes are made.

• Protect against those risks. For example, strict rules for changing passwords, anti-virus software, firewalls and staff training.

• Detect when breaches have occurred. For example, review customer reports, analyse data flows, analyse processing patterns, continually monitor network statistics.

• Respond to breaches in cyber security. For example, assess the effect of any breach, start using back-up systems, reassure stakeholders, pay compensation to those affected, take measures to block any reoccurrence of the breach.

System security needs to be assessed regularly and proactively and not just as a reaction to a breach. Therefore, management should appoint a specialist committee or team whose brief is to manage cyber risks. Identified risks should be recorded in a risk register where decisions and actions will also be recorded.

It is common for organisations also to issue customers with a privacy policy statement explaining what data is held and how it is used, and some publish a website security document as well. British Airways' website security page is one published example: it gives customers advice on staying safe online and sets out some of the measures the company takes. Not every detail of an organisation's precautions will ever be made public, and it should not be.

5.2 Protecting against cyber attack

• A set of comprehensive policies and processes must be developed that will protect the organisation’s network and data so that essential services can be delivered.

• Identity checks and access control must be implemented so that users who have access to data are properly verified, authenticated and authorised. Think of verification as checking that a person is who they say they are (essential for issuing access credentials) and authentication is a verified person having to prove who they are each time they log-on.

• Data security. Data being stored or transmitted must be protected against unauthorised access, modification or deletion. For example, the use of passwords, encryption and back-ups will help to ensure data security.

• System security. Opportunities to attack systems (vulnerabilities) arise from:

  • flaws in the design of systems

  • features

  • user error.

For example, there should be procedures in place to ensure that software patches to counter flaws in software design are promptly implemented. Features should be kept under review and removed if not required. Users must be trained to avoid serious user error, such as leaving laptops unattended in cars.

• Resilient networks. For example, are networks well-designed with, perhaps, built-in spare capacity. Is a parallel system running at a remote location so that it can be switched to if the main system breaks down? Is the bandwidth of the network high enough to comfortably deal with peak demand?

• Staff awareness and training. Staff behaviour should be in line with the organisation’s data protection policies and procedures and training is needed to ensure that this happens. It is also important to foster a security culture in which staff take an active role in maintaining and improving security.

5.3 Detecting cyber security events

An effective monitoring system must be in place so that security breaches and attempted security breaches are discovered. Once discovered there should be appropriate processes in place to make appropriate responses. For example, organisations can monitor the web addresses that employees are accessing. Email traffic might allow phishing attacks (where a malicious site poses as a legitimate one). Threat intelligence can be used to identify connections to IP addresses of sites known to be dangerous.

In addition to monitoring known indicators of cyber threats, organisations should also develop the capability of identifying unknown or expected threats. For example, unusual patterns of data flows around the network, user activity outside normal hours, the retrieval of a large volume of design documents.

5.4 Minimising the impact of cyber security eventss

First there should be response and recovery planning and there should be an incident response plan (for extreme incidents, sometimes known as a disaster recovery plan). Amongst other things, this plan should indicate how to assess the seriousness of the incident, how the effects of the incident might be minimised, allocate staff responsibilities and the steps they should take, how a back-up or stand by system can be switched to, how public and customer relations should be managed.

It is also important to assess how the incident occurred and what measures might prevent a repeat in the future.

6 Centralisation in cyber security

⚠️ This is not the same subject as §3.4. There, what was centralised or distributed was the IT architecture — where the computers are and where the processing happens. Here, what is centralised is the security function. The two are independent: an organisation can run a thoroughly distributed architecture, with cloud services and local servers in twenty countries, and still run one central security function over the whole of it — and usually should.

The reason is the simplest fact in cyber security. An attacker only has to find the weakest part. If security policy, patching, access control and monitoring are each divisional decisions, the group's security is the security of whichever division took them least seriously — and no one at the centre knows which division that is. Centralisation is how an organisation stops being as strong as its weakest unit.

6.1 Centralised management

Centralised management is about setting and enforcing one standard. In practice it covers:

• One set of policies and standards across the organisation, with one owner, rather than a policy per division that nobody reconciles.

• One identity and access management system — a single directory in which joiners, movers and leavers are processed once, with single sign-on and multi-factor authentication enforced centrally. The commonest serious finding in any access audit is the leaver whose account still works, and it is a finding that federated identity almost guarantees.

• Central patch and configuration management — one authoritative build, with patches pushed on a schedule rather than requested and negotiated. Both of the bank incidents in §4 were update failures, so this is not costless; the answer is central control with proper testing, not local discretion.

• A single asset inventory — you cannot protect what you do not know you own, and unknown servers, forgotten cloud accounts and unmanaged laptops are where attackers get in.

• Central procurement and third-party security assessment, so that suppliers and cloud providers are assessed once, to one standard (§3.5, and ISO 27001's supplier controls in §7).

• One incident response plan and one team with the authority to act across the group — to isolate a network segment or take a service down — without first negotiating with a divisional managing director.

• Central control of the security budget, so that money goes where the risk is rather than where the loudest division is.

6.2 Centralised monitoring: the security operations centre

Centralised monitoring is the operational half, and it is where the detection objective of §5.3 actually happens. Two terms are worth knowing:

Why aggregation is the whole point. A serious attack is almost never visible in any single log. Consider four events on one night: a handful of failed logins against a server in one country; a successful login to a different system from the same address twenty minutes later; a large volume of files read from a design repository at three in the morning; and an outbound connection to an address nobody recognises. Each is unremarkable on its own, and each sits in a different system owned by a different team. Side by side and in sequence they are an intrusion and an exfiltration. Only centralised monitoring puts them side by side.

Around that core sit three things worth naming:

• Threat intelligence — feeds of known malicious addresses, files and techniques, so the SIEM can flag a connection to a site that is already known to be dangerous.

• Behavioural detection — as §5.3 says, the organisation must also find threats it has no signature for. That means establishing what normal looks like — normal data flows, normal working hours, normal volumes — and alerting on departures from it.

• Orchestration and automated response — pre-agreed actions the system can take without waiting for a person: disable an account, quarantine a device, block an address. Speed is the whole value.

The measures that matter are mean time to detect and mean time to respond. They are also the two numbers a board and a risk committee can actually understand, which is why they belong in the cyber risk reporting of §10.

An organisation too small to staff a 24-hour SOC of its own can buy the service — a managed security service provider. That is a sensible use of a scarce and expensive skill, and it raises exactly the third-party questions of §3.5: what can the provider see, where is it held, and what happens when the provider is the one that is breached.

6.3 The trade-off, and the risks centralisation creates

Centralisation is not free, and an exam answer that only lists benefits has answered half the question.

The usual answer in practice is a hybrid: central policy, central identity, central monitoring and central incident authority, with local implementation and local knowledge feeding it. The board's part in this is §10's governance criterion and, where there is one, the risk committee of Chapter 5.

7 ISO 27001

ISO/IEC 27001 is the international standard for an information security management system. It does two things: it specifies how an organisation should establish, operate and continually improve a management system for information security, and its Annex A lists a set of controls to be considered.

You will not be asked to reproduce ninety-three controls. What is worth carrying into the exam is the four themes and the kind of control each contains, so that you can say what an organisation's arrangements are missing:

Two observations that earn marks. First, the standard is overwhelmingly not technical — the organisational and people themes together account for the larger part of it, which is the same point the fraud triangle makes in Chapter 6: the control that fails is usually the human one. Second, certification to ISO 27001 is evidence that a management system exists and is audited, not a guarantee that the organisation will not be breached; a scenario that offers certification as an answer to a specific control weakness has not answered it.

8 Cyber security tools and techniques

8.1 Forensic analysis

‘Forensic’ implies that findings will be presented in a court of law or possibly some legal argument or negotiation such as the amount of compensation that can be claimed under an insurance arrangement.

Computer forensics techniques discover, preserve and analyse information on computer systems. This involves more than just switching on the computer and searching the hard drive. Simply opening a file to read it changes it (for example date and time accessed) and therefore evidence has been changed by the action of the investigator. Therefore, when computers are seized by the police, their first action will be to remove the hard drive and to preserve the data in a completely unchanged state.

Forensic analysis will also, for example, extend to network analysis where the results can show who was logged on to the system at any time, what operations they carried out, what web-sites were accessed etc.

8.2 Malware analysis

This process aims to understand what a piece of malware does and how it does it. The analysis might discover ways in which the malware can be countered.

Malware analysis often uses reverse engineering, decompilation and disassembly. What does that mean? Well, when computers are running a program, the instructions they follow have usually been converted from source code (the language they were written in) to object code (for example, a series of 1s and 0s that the computer uses ie, binary code). Therefore, malware, when it is found, will rarely be in human-readable form. The malware analyst has to take the sequences of binary code and work back to the original programming statements so that the operation of the malware can be understood.

8.3 Penetration testing

Penetration testing (‘a pen test’) is an authorised simulated cyber attack on a computer system. It is a controlled form of hacking where the hackers act on behalf of the client to probe the system for vulnerabilities. Once vulnerabilities have been found and reported, the client must take action to remedy the weaknesses and the penetration test should be repeated to see if the measures taken have been successful.

A penetration test runs in three stages, and the syllabus names all three. Network discovery maps what is actually there — which hosts are reachable, which ports are open, which services are running on them and at which software versions. This alone is often a finding, because what is on the network is rarely what the asset register says is on the network. Vulnerability probing then tests each of those against known weaknesses: software that has not been patched, default or shared credentials, permissions that were widened for a project and never narrowed again, services exposed to the internet that should face inwards only. Exploiting the vulnerabilities is the third stage, and it is what separates a penetration test from a vulnerability scan: the tester actually uses the weakness — to get in, to move sideways from the system first entered to a more valuable one, and to reach data. That matters for prioritising the remediation, because a weakness that cannot in practice be exploited is a lower priority than one that gives an attacker the customer database in two steps.

Sometimes the terms ‘black hat’ and ‘white hat’ are used to describe hackers:

• Black hat hackers: these are the baddies, illegally hacking systems for personal gain, political reasons or just for fun.

• White hat hackers: these are the good guys who try to penetrate systems on behalf of the systems owners so that system security can be improved.

Some white hat hackers may have started as black hat hackers but then decided to switch from the dark side, perhaps after a brush with the law and the opportunity to study the inside of a prison cell.

8.4 Software security

Software security means trying to protect software (ie programs) against malicious attacks so that the software continues to operate in the way it was designed to. For example, a program accessing a database could potentially be altered so that data was harvested, changed or deleted.

Software security can be enhanced by using good programming techniques, firewalls and intruder protection. New or amended software should be used only after strict authorisation and testing. Master copies of programs can be held off-line (so not subject to network attack) and the user copies of the software can be compared from time to time to the master copies to identify any changes.

Software security can be designed in layers with security set at an appropriate level for the processing being carried out and data being accessed. For example:

So, a university might use the following security layers for applications

9 Practical controls

Controls in computer systems can be categorised as general controls and application controls.

9.1 General controls

These are policies and procedures that relate to the computer environment and which are therefore relevant to all applications. They support the effective functioning of application controls by helping to ensure the continued proper operation of information systems.

General IT controls that maintain the integrity of information and security of data commonly include controls over the following:

• Data centre and network operations. A data centre is a central repository of data and it is important that controls there include back-up procedures, anti-virus software and firewalls to prevent hackers gaining access. Organisations should also have disaster recovery plans in place to minimise damage caused by events such as floods, fire and terrorist activities.

• System software acquisition, change and maintenance. System software refers to operating systems, such as Windows or Apple’s OS. These systems often undergo updates as problems and vulnerabilities are identified and it is important for updates to be implemented promptly.

• Application system acquisition, development, and maintenance. Applications systems are programs that carry out specific operations needed by the company – such as calculating wages and invoices and forecasting inventory usage. Just as much damage can be done by the incorrect operation of software as by entering incorrect data. For example, think of the damage that could be done if sales analyses were incorrectly calculated and presented. Management could be led to withdraw products that are, in fact, very popular. All software amendments must be carefully specified and tested before implementation.

• Access security. Physical access to file servers should be carefully controlled. This is where the company keeps its data and it is essential that this is safeguarded: data will usually endow companies with competitive advantage. Access to processing should also be restricted, typically through using log-on procedures and passwords.

9.2 Application controls

Application controls are manual or automated procedures that typically operate at a business process level, such as the processing of sales orders, wages and payments to suppliers.

These controls help ensure that transactions are authorised, and are completely and accurately recorded, processed and reported. Examples include:

Three points about this list are worth carrying into an answer. A format check and a check digit are not the same thing: a mistyped number can be exactly the right shape and still fail the rule, and the format check will never see it. The usual method is modulus 11. Take the digits of a six-digit account number, weight them 7, 6, 5, 4, 3, 2 from the left, add the products, and choose the check digit — carried as a seventh digit with a weight of 1 — so that the weighted total divides exactly by 11. On entry the system repeats the sum; if it does not divide by 11 the number is rejected before anything else happens. Note the limits: modulus 11 catches every single-digit error and every simple transposition of adjacent digits, but two compensating errors can still pass, and a number that passes may still belong to no account — that is what an existence check is for. These are also application controls — they work only if the general controls of §9.1 are sound, because anyone who can change the program can remove the check as easily as it was written.

On-line, real time systems can pose particular risks because any number of employees could be authorised to process certain transactions. Anonymity raises the prospect of both carelessness and fraud so it is important to be able to trace all transactions to their originator. This can be done by tagging each transactions with the identity of the person responsible.

Cyber-espionage is also a growing threat. Governments, competitors and criminals attempt to steal intellectual property or information about customers and contracts. Quite obviously the theft of valuable know-how will undermine a company’s competitive advantage and it is essential for organisations to defend themselves as far as possible against these threats.

10 Reporting cyber risk

An organisation’s key stakeholders will want to know that the organisation is taking adequate steps to manage cyber risk. Stakeholders know that cyber breaches can affect the organisation’s ability to function properly, might cause confidential data to be released and might cause contamination of other systems. It is therefore important that the organisation’s approach to cyber risk management is made public to stakeholders so that they gain some assurance about risk mitigation.

A possible framework for cyber risk management is as follows (CGMA Cybersecurity Tool).

• Nature of the business and operations. Naturally, many of the risks that organisations are exposed to depend on their business and operations. For example, an aircraft manufacturer will possess valuable intellectual property and there is a cyber risk that this will be stolen. On the other hand, supermarkets are less likely to have that type of data.

• Nature of the information at risk. Following on from above, the organisation will list the principal types of data it stores, uses and transmits.

• Risk management programme objectives. This sets out what degree of risk mitigation the organisation wants to achieve for each item of data. For example, data showing customers’ credit card details needs a very high level of security. Data about wages and salaries, though personal and sensitive, is less likely to lead to losses or theft.

• Specific factors affecting cybersecurity risks. For example, a company in which each employee has a laptop which they take to clients and perhaps take home, runs specific risks relating to laptop theft and therefore theft of the data it contains. Stakeholders would expect all sensitive data on the laptops to be encrypted. Another example is where an organisation holds very sensitive data about patients’ medical histories. There, you would normally expect a complex password system so that hospital staff (which includes administrators) see only the data they need to carry out their jobs.

• Cyber risk governance structure. Board oversight, risk committees, procedures for identifying risks and dealing with breaches, ethical commitment, training, ensuring staff are up-to-date and properly qualified.

There follow several examples of how large companies have reported cyber risks in the risk section of their annual reports

Four examples follow, all taken from the risk sections of real annual reports. They are reproduced as published and are dated: all four are from reports for 2018 or earlier, which is worth knowing when you read them, and the IAG extract in particular records a breach that had just happened. Read them for the SHAPE of a good disclosure rather than for the current position of any of these companies.

10.1 BAE Systems

Mandated risk policy:

Identification     Analysis     Evaluation     Mitigation

10.2 Smiths Group plc

10.3 IAG (International Airlines Group)

10.4 Unilever plc

11 Big data

11.1 What big data is

There are many definitions of the term ‘big data’ but most suggest something like the following:

“Extremely large collections of data (data sets) that may be analysed to reveal patterns, trends, and associations, especially relating to human behaviour and interactions.”

In addition, many definitions also state that the data sets are so large that conventional methods of storing and processing the data will not work.

In 2001 Doug Laney, an analyst with Gartner (a large US IT consultancy company) stated that big data has the following characteristics, known as the 3Vs:

• Volume

• Variety

• Velocity

These characteristics, and sometimes additional ones, have been generally adopted as essential qualities of big data.

The commonest fourth ‘V’ that is sometimes added is veracity: Is the data true? Can its accuracy be relied upon?

11.2 Volume

The volume of big data held by the largest retailers, technology companies and marketplaces is measured in petabytes. A petabyte is 10¹⁵ bytes; a typical personal computer disc holds about 10⁹ bytes, a gigabyte. So a single one of those data stores holds at least what a million ordinary computers would hold, and often ten or twenty times that.

These numbers probably mean little even when converted into equivalent PCs. It is more instructive to list some of the types of data that large companies will typically store.

11.3 Variety

Some of the variety of information can be seen from the examples listed above. In particular, the following types of information are held:

Browsing activities: sites, pages visited, membership of sites, downloads, searches

Financial transactions

• Interests

• Buying habits

• Reaction to ads on the internet or to advertising emails

• Geographical information

• Information about social and business contacts

• Text

• Numerical information

• Graphical information (such as photographs)

• Oral information (such as voice mails)

• Technical information, such as jet engine vibration and temperature analysis

This data can be both structured and unstructured:

Structured data: this data is stored within defined fields (numerical, text, date etc) often with defined lengths, within a defined record, in a file of similar records. Structured data requires a model of the types and format of business data that will be recorded and how the data will be stored, processed and accessed. This is called a data model. Designing the model defines and limits the data that can be collected and stored, and the processing that can be performed on it.

An example of structured data is found in banking systems, which record the receipts and payments from your current account: date, amount, receipt/payment, short explanations such as payee or source of the money.

Structured data is easily accessible by well-established database structured query languages.

Unstructured data: refers to information that does not have a pre-defined data-model. It comes in all shapes and sizes and this variety and irregularities make it difficult to store it in a way that will allow it to be analysed, searched or otherwise used. An often quoted statistic is that 80% of business data is unstructured, residing in word processor documents, spreadsheets, PowerPoint files, audio, video, social media interactions and map data.

11.4 Velocity

Information must arrive quickly enough to be of use in the decision it is meant to support. A price-comparison offer texted to a customer after they have left the shop is worthless; facial recognition used to greet a returning hotel guest by name has to work in the second or two before the guest reaches the desk. Volume and variety conspire against velocity: methods have to be found to process huge quantities of non-uniform, awkward data in something close to real time, which is the whole reason big data needed new technology rather than a bigger database.

11.5 Software for big data

The processing of big data is generally known as big data analytics and includes:

Data mining:     analysing data to identify patterns and establish relationships such as associations (where several events are connected), sequences (where one event leads to another) and correlations.

Predictive analytics:     a type of data mining which aims to predict future events. For example, the chance of someone being persuaded to upgrade a flight.

Text analytics:     scanning text such as emails and word processing documents to extract useful information. It could simply be looking for key-words that indicate an interest in a product or place.

Voice analytics:     as above with audio.

Statistical analytics:     used to identify trends, correlations and changes in behaviour.

The analytical findings can lead to:

• Better marketing

• Better customer service and relationship management

• Increased customer loyalty

• Increased competitive strength

• Increased operational efficiency

• The discovery of new sources of revenue.

11.6 Dangers of big data

Despite the examples of the use of big data in commerce, particularly for marketing and customer relationship management, there are some potential dangers and drawbacks.

Cost:     It is expensive to establish the hardware and analytical software needed, though these costs are continually falling.

Regulation:     Some countries and cultures worry about the amount of information that is being collected and have passed laws governing its collection, storage and use. Breaking a law can have serious reputational and punitive consequences.

Loss and theft of data:     Apart from the consequences arising from regulatory breaches as mentioned above, companies might find themselves open to civil legal action if data were stolen and individuals suffered as a consequence.

Incorrect data (veracity):     If the data held is incorrect or out of date incorrect conclusions are likely. Even if the data is correct, some correlations might be spurious leading to false positive results.

Employee monitoring:     Data collection methods allow employees to be monitored in detail every second of the day. Some companies place sensors in name badges so that employee movements and interactions at work can be monitored. The badges record to whom each employee talks and in what tone of voice. Stress levels can be measured from voice analysis also. Obviously, this information could be used to reduce stress levels and to facilitate better interactions but you will easily see how it could easily be used to put employees under severe pressure.

12 Protecting personal data

Most cyber incidents that reach a board involve personal data, and where they do, the penalty is set by data-protection law rather than by the size of the loss. A breach that costs the organisation nothing directly can still attract a fine measured against its global turnover, which is why this is a risk topic and not a legal footnote.

P3 names no national regime, so learn the model, which is now followed in similar form in many jurisdictions. The named illustration used here is the European General Data Protection Regulation (GDPR) and, in the United Kingdom, the UK GDPR together with the Data Protection Act 2018. Expect a question to supply any specific rule or figure it needs.

12.1 Who the rules apply to

• Personal data — information relating to an identified or identifiable living individual. Not data about companies. Some categories, such as health, biometric and criminal-offence data, attract stricter conditions.

• Data subject — the individual the data is about.

• Controller — the organisation that decides why and how personal data is processed. It carries the primary obligations.

• Processor — an organisation that processes data on a controller's behalf, such as a cloud provider or an outsourced payroll bureau. It has obligations of its own, and the controller must have a written contract with it — which is the point at which §3.5's cloud risk becomes a legal exposure as well as an operational one.

12.2 The principles

Personal data must be:

• processed lawfully, fairly and transparently — there must be a lawful basis, and people must be told what is happening to their data;

• collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with them (purpose limitation);

• adequate, relevant and limited to what is necessary (data minimisation);

• accurate and, where necessary, kept up to date;

• kept in identifiable form no longer than necessary (storage limitation);

• processed with appropriate security — protection against unauthorised or unlawful processing and against accidental loss, destruction or damage (integrity and confidentiality). This is the principle everything else in this chapter serves.

Over all six sits accountability: the controller must not only comply but be able to demonstrate that it complies. In practice that means records of processing activities, a data protection impact assessment before high-risk processing, privacy by design and by default, a data protection officer where one is required, and training. Accountability is what turns data protection from a policy into something an internal auditor can test (Chapter 6).

12.3 Lawful bases, and the rights of the individual

Processing needs a lawful basis, chosen before processing starts. Under the EU GDPR there are six: consent; performance of a contract; a legal obligation; vital interests; a public task; or the legitimate interests of the controller or a third party, balanced against the individual's rights. That six-basis list is the model to learn, and it is the one most jurisdictions have copied. Consent is one basis among several, not the default — it must be freely given, specific, informed and unambiguous, and it can be withdrawn.

The UK has since added a seventh. The Data (Use and Access) Act 2025 inserted recognised legitimate interests into the UK GDPR: for a closed list of purposes fixed in law — among them national security and defence, emergencies, safeguarding, the detection and prevention of crime, and disclosures to public bodies that request data for their own statutory functions — a controller may rely on legitimate interests without carrying out the balancing test, because Parliament has already made that judgement. Everything outside that closed list still needs the ordinary balancing test where ordinary legitimate interests are relied on. The EU GDPR still has six; other jurisdictions differ again, and a scenario will supply its own regime. ⚠️ Do not present the six-basis list as current UK law, and do not carry the UK's seventh basis across to the EU regime; the ICO's lawful-basis guidance is the authority for the UK position.

Individuals have rights that the organisation's systems have to be capable of honouring, which is a systems design point as much as a compliance one:

• to be informed about what is collected and why;

• of access — to obtain a copy of their data;

• to rectification of inaccurate data;

• to erasure in defined circumstances;

• to restrict processing;

• to data portability — to receive their data in a usable format;

• to object to certain processing, including direct marketing;

• in relation to automated decision-making and profiling — which is where §11's big data analytics meets this section.

12.4 Breach notification — the reason detection matters

Under the GDPR model — a scenario set in another jurisdiction will supply its own clock and its own penalty ceiling — a personal data breach must be reported to the supervisory authority without undue delay and, where feasible, within 72 hours of the organisation becoming aware of it, unless it is unlikely to result in a risk to individuals. Where the risk to individuals is high, they must be told as well, without undue delay. Breaches must be recorded whether or not they are reportable.

Read that against §6.2. Two separate obligations are in play, and they must not be run together. The notification clock starts when the organisation becomes aware of the breach, so an organisation that takes six weeks to detect one and then reports without undue delay, and within 72 hours of finding it, has met the notification deadline — both limbs, because the 72 hours is an outer limit and not a licence to take all of it. What it may not have met is the security principle: taking six weeks to notice may evidence that its security, monitoring and detection were not appropriate, and that is what the authority will assess — under a different obligation, with its own penalty tier. Delay is not itself the test; the question is whether the measures were appropriate, and elapsed time alone does not establish that they were not. A regulator may also ask whether the organisation ought to have been aware sooner, because awareness is judged on what a reasonably competent organisation with these systems would have known, not on when someone happened to look. The security operations centre is therefore two things at once: an operational control, and what keeps the point of awareness close to the point of breach so that both duties can be met.

12.5 Transfers, and penalties

Personal data may be transferred to another country only where the protection travels with it: under an adequacy decision (the receiving country's regime is judged to give equivalent protection), or under appropriate safeguards such as standard contractual clauses or binding corporate rules, with an assessment of the receiving country's law; specific derogations, such as the individual's explicit informed consent or necessity for a contract, remain available for occasional transfers. The predecessor rule was not a flat prohibition either — it restricted transfers outside the European Economic Area to countries with adequate protection and listed its own exceptions — but the current test is broader and is expressed as protection travelling with the data. It matters directly to cloud services (§3.5) and to any group with a shared customer database.

Penalties run in two tiers. The higher tier — for breaches of the principles, the lawful bases, the rights of individuals, or the transfer rules — reaches 4% of total worldwide annual turnover or €20 million, whichever is higher (in the UK, £17.5 million). The lower tier, for obligations such as security measures, records and breach notification, is half of that. Authorities also have powers short of a fine: to order processing to stop, which for a data-driven business can be far more damaging than the money.

Two consequences for a P3 answer. The penalty is measured against group turnover, not against the profit of the division that lost the data, so a data breach in a small subsidiary is a group-level risk; and because the exposure scales with revenue rather than with the incident, personal data belongs on the principal risks register and in the cyber risk report of §10, not in an IT department's own log.

13 Disaster planning

Many organisations are so reliant on the continued availability of IT that to be without it for even a short time can be very damaging. A more serious incident can make an IT system unavailable for weeks, and that can be terminal.

The following is from Computer Weekly, June 2015:

Royal Bank of Scotland (RBS) customers suffered at the hands of another IT problem as hundreds of thousands of payments failed to reach their accounts. About 600,000 payments including tax credits and disability living allowance did not arrive when expected.

RBS has been subject to costly IT problems in recent years. In 2012 customers were locked out of their accounts for days, as a result of a glitch in the CA-7 batch process scheduler, which froze 12 million accounts. Customers were left unable to access funds for a week or more as RBS, NatWest and Ulster Bank manually updated account balances.

RBS was fined £56m by the Financial Conduct Authority (FCA) and the Prudential Regulation Authority (PRA) as a result.

Companies should have disaster plans that will first offer some protection against problems but which will then allow the company’s IT system to be up and running (at least the most vital elements of the system) as soon as possible.

⚠️ Those illustrations are dated — the RBS incidents are from 2012 and 2015 — and they are kept because they are unusually well documented, not because they are recent. The pattern they show has not changed: a routine update, inadequately tested, taking a bank's core systems down for a week, followed by a regulatory penalty an order of magnitude larger than the cost of the testing that was skipped. Note also what §12.4 now adds to a story like this one: where customer personal data is affected, the clock on breach notification starts as soon as the organisation becomes aware.

Typical contents of a disaster plan are:

• Minimise physical risks; take regular backups of data

• Contingency planning: standby procedures, recovery procedures, personnel management:

  • Define responsibilities of staff members. Remember, normal working will have been disrupted.

  • Risk assessment – where is most attention needed? Where are we most vulnerable?

  • Prioritise – which elements of the system are the most vital to get back?

  • Back-ups and stand-by arrangements – if the computer is damaged, a standby machine (hardware duplication) will be able to pick up the processing. It should be located at a remote site.

  • Communication with staff and customers. A disaster can undermine confidence so good PR is essential.

• Business continuity planning. How will the business be carried on until normal service is resumed?

14 Test your knowledge

Two quick checks before you move on: work through the flashcards to fix this chapter’s key terms and definitions, then sit the objective questions for exam-style practice. Both mark themselves and explain the answers as you go.