Threats and risk · Cyber Security Basics

Why you need it

The intuition

Definition

CIA triad

Confidentiality, integrity and availability: the three properties security protects. Data is kept secret from the wrong people, unchanged by the wrong people, and reachable by the right people.

Risk

A simple risk score is likelihood × impact, each rated on a small scale such as 1 to 5. Higher scores are fixed first.

Examples

1
2
3
4
5
6
7

incidents = {
    "Someone reads the customer list": "confidentiality",
    "A price is changed from 100 to 1": "integrity",
    "The website is down for 3 hours": "availability",
}
for event, goal in incidents.items():
    print(goal.upper(), "-", event)

1
2
3
4
5
6
7
8
9
10
11
12
13
14

risks = [
    ("Weak admin password", 4, 5),
    ("Stolen laptop", 2, 4),
    ("Server disk full", 3, 2),
]

def score(risk):
    name, likelihood, impact = risk
    return likelihood * impact

for risk in risks:
    print(risk[0], score(risk))
ranked = sorted(risks, key=score, reverse=True)
print("Fix first:", ranked[0][0])

Common mistakes

Quick quiz

1
2
3
4
5
6
7
8
9

likelihood = 3
impact = 4
score = likelihood * impact
if score >= 15:
    print("high")
elif score >= 8:
    print("medium")
else:
    print("low")

Practice

3 exercises in three steps: predict what a program prints, change a program to meet a new requirement, then write one from scratch. Your code runs in the browser and is checked the moment you submit.

1. PredictBiggest risk

   Type exactly what this program prints.

2. ModifyOnly the serious ones

   The program prints every risk with its score. Change it so it prints only risks with a score of 10 or more, in this form:

   HIGH: Weak admin password (20)

3. WriteRisk level

   Write a function risk_level(likelihood, impact) that returns:

   • "high" when likelihood × impact is 15 or more
   • "medium" when it is 8 or more
   • "low" otherwise

Terms in this lesson