Cybersecurity, Privacy and Digital Risk

Introduction

Digital technologies enable organisations to collect information, process transactions, communicate with customers and coordinate complex supply chains. These benefits also create exposure. A stolen password can provide access to financial systems; a misconfigured cloud database can disclose customer records; ransomware can halt operations; and an unreliable technology supplier can interrupt an essential service. Cybersecurity and privacy are therefore not merely technical concerns. They are business responsibilities involving governance, people, processes, technology and ethical judgement.

Cybersecurity is the protection of information systems, networks, devices and data from unauthorised access, use, alteration, disruption or destruction. Privacy concerns the appropriate collection, use, disclosure, retention and disposal of information about identifiable people. Digital risk is the possibility that technology-related events will produce financial, operational, legal, reputational or social harm.

The central managerial task is not to eliminate all risk, which is impossible, but to identify important risks, reduce their likelihood and impact, and prepare the organisation to respond and recover.

Learning Objectives

By the end of this chapter, students should be able to:

1. Distinguish threats, vulnerabilities, risks and controls.
2. Explain common cybersecurity threats and assess their likely business effects.
3. Apply authentication, authorisation and access-control principles.
4. Explain the business uses and limitations of encryption.
5. Design sensible backup and continuity arrangements.
6. Apply the stages of incident response.
7. Assess privacy responsibilities and ethical data practices.
8. Evaluate third-party technology and supply-chain risks.
9. Recommend proportionate cybersecurity controls for a business scenario.

A Risk-Based View of Cybersecurity

A threat is a potential cause of harm. Threats may be external, such as criminals, competitors or hostile states, or internal, such as careless employees, dishonest insiders or poorly designed processes. A vulnerability is a weakness that a threat can exploit. Examples include unsupported software, excessive user privileges, weak passwords, an unencrypted laptop or inadequate staff training.

A risk exists when a threat can exploit a vulnerability and produce an undesirable consequence. Risk assessment considers both likelihood and impact. A simple qualitative model is:

Likelihood describes how probable an event is within a defined period, while impact describes the scale of harm if it occurs. This is a planning model rather than a precise law of nature. Organisations often use categories such as low, medium and high, because reliable numerical probabilities are not always available.

A control is a safeguard that reduces the likelihood or impact of a risk. Controls may be:

• Preventive: stop an incident, such as multi-factor authentication.
• Detective: identify an incident, such as an intrusion alert.
• Corrective: restore or repair, such as recovery from backup.
• Directive: establish expected behaviour, such as an information-security policy.

Controls can also be administrative, technical or physical. A policy is administrative; access permissions are technical; locked server rooms are physical. Effective security uses layers rather than relying on one safeguard. This is known as defence in depth.

Common Threats

Phishing uses deceptive messages to persuade people to reveal credentials, transfer money or open malicious files. Spear phishing is tailored to a particular person, while business-email compromise may imitate an executive or supplier.

Malware is malicious software. Viruses attach to files, worms spread across networks, trojans disguise themselves as legitimate programs, spyware gathers information, and ransomware encrypts or blocks access to data while demanding payment.

Credential attacks include password guessing, credential stuffing using previously leaked passwords, and theft through fake login pages. Reusing a password across services increases the consequences of one breach.

Web and application attacks exploit weaknesses such as injection, insecure authentication, inadequate input validation or exposed application interfaces. A successful attack may alter transactions or access databases.

Denial-of-service attacks overwhelm a service with traffic or requests, making it unavailable to legitimate users. A distributed denial-of-service attack uses many compromised devices.

Insider risks arise from authorised users. They may be malicious, negligent or compromised by an attacker. An employee who emails a customer file to the wrong recipient creates a privacy and security incident even without malicious intent.

Social engineering exploits trust, urgency, fear or authority rather than a software flaw. For example, an attacker may telephone an employee pretending to be from the IT department and request a one-time authentication code.

Authentication and Access Control

Authentication and Authorisation

Authentication answers, “Who are you?” Authorisation answers, “What are you allowed to do?” Authentication should precede authorisation, but proving identity does not automatically justify every action.

Authentication factors are commonly classified as:

1. Something the user knows: a password or PIN.
2. Something the user has: a security key, smart card or registered phone.
3. Something the user is: a fingerprint or facial characteristic.

Multi-factor authentication (MFA) combines two or more different factor categories. A password plus a code generated by an authenticator application is MFA; a password plus two different passwords is not, because both are knowledge factors. MFA substantially reduces the value of stolen passwords, although phishing-resistant security keys provide stronger protection than codes that can be socially engineered.

Passwords should be long, unique and stored by systems as salted, computationally expensive hashes rather than in plaintext. A salt is a unique random value combined with a password before hashing. Hashing is a one-way transformation intended for verification, whereas encryption is reversible with a key.

Access-Control Principles

The principle of least privilege gives users only the access needed for their current duties. Need-to-know limits access to information required for a specific task. Separation of duties divides sensitive activities among people so that one individual cannot complete an entire high-risk transaction alone. For example, one employee may create a supplier and another approve payment.

Access should be managed through a lifecycle:

1. Create an account only after an approved business need.
2. Assign a role and minimum required permissions.
3. Review permissions periodically and when duties change.
4. Remove or suspend access promptly when employment ends.
5. Log significant access and administrative actions.

Role-based access control assigns permissions to job roles rather than individually to every user. This simplifies administration, but poorly designed roles can still grant excessive access. Privileged accounts, such as database administrators, require stronger controls, monitoring and separate credentials. Temporary or just-in-time privileges reduce the period during which powerful access is available.

Encryption and Data Protection

Encryption transforms readable plaintext into ciphertext using an algorithm and key. Decryption reverses the process for an authorised party. Encryption protects confidentiality, but it does not by itself guarantee that data are accurate, available or being used lawfully.

Symmetric encryption uses the same secret key to encrypt and decrypt data. It is efficient for large volumes of information, but the key must be shared securely. Asymmetric encryption uses a public key and a private key. Data encrypted with a recipient’s public key can generally be decrypted only with the corresponding private key. Asymmetric methods support secure key exchange and digital signatures, but are computationally more expensive.

In practice, systems often use a hybrid approach: asymmetric cryptography establishes or protects a session key, and symmetric encryption protects the data transmission. Encryption in transit protects data moving across networks; encryption at rest protects stored data on devices, databases or backups. Key management is critical. Keys should be generated securely, access-controlled, rotated when appropriate, backed up safely and revoked when compromised.

A digital signature uses a private key to provide evidence of origin and detect alteration. It supports integrity and authentication, but it does not necessarily provide confidentiality. A hash produces a fixed-length digest of data. If the data change, the digest should change, making hashes useful for integrity checking. Hashes are not a substitute for encryption when secrecy is required.

Encryption has limitations. If an attacker gains access to an unlocked device or an authorised application, encrypted data may be displayed normally. Lost keys can make legitimate recovery impossible, while stolen keys can allow decryption. Organisations must therefore combine encryption with access control, endpoint protection, secure configuration and monitoring.

Backup, Recovery and Business Continuity

A backup is a separate copy of data maintained so that information can be restored after deletion, corruption, hardware failure, cyberattack or disaster. Backups should be tested; an untested copy is only an assumption of recoverability.

Important backup distinctions include:

• Full backup: copies all selected data.
• Incremental backup: copies data changed since the most recent backup of any type.
• Differential backup: copies data changed since the last full backup.
• Offline backup: not continuously connected to production systems.
• Immutable backup: protected from alteration or deletion during a defined retention period.

The 3-2-1 principle recommends at least three copies of important data, on two different types of media, with at least one copy off-site. Modern practice often adds offline or immutable protection because ransomware may attack connected backups.

Two recovery measures are especially important. The recovery point objective (RPO) is the maximum acceptable amount of data loss measured in time. An RPO of four hours means the organisation aims to restore data to a point no more than four hours before the disruption. The recovery time objective (RTO) is the target maximum time required to restore a service.

For example, an online retailer may set an RPO of 15 minutes for orders and an RTO of two hours for its checkout service. These targets require frequent replication, suitable infrastructure and tested procedures. They also cost more than arrangements designed for less critical systems.

Business continuity concerns maintaining critical operations during disruption. Disaster recovery focuses particularly on restoring technology and information services. A continuity plan should identify critical processes, dependencies, responsible staff, communication methods, alternative facilities and manual workarounds. Plans must be exercised through simulations because written procedures may fail when staff, suppliers or systems are unavailable.

Incident Response

An incident is an event that threatens the confidentiality, integrity or availability of information or systems. Incident response is a structured process for limiting harm and restoring normal operations. A practical lifecycle includes:

1. Preparation: establish policies, roles, contact lists, logging, tools, training and legal procedures.
2. Detection and analysis: identify suspicious activity, preserve evidence and determine scope, affected assets and severity.
3. Containment: limit spread or ongoing loss. Short-term containment may isolate a device; longer-term containment may block an account or segment a network.
4. Eradication: remove malware, close the exploited weakness, reset credentials and eliminate persistence.
5. Recovery: restore systems carefully, validate integrity, monitor for recurrence and return to normal operations.
6. Lessons learned: document causes, decisions, control failures and improvements.

Incident response requires both technical and managerial coordination. Legal, privacy, communications, human resources, senior management and affected business units may all be involved. Evidence should be preserved with reliable timestamps and a clear chain of custody where disciplinary or legal proceedings are possible. Organisations should not destroy logs or immediately wipe devices before determining whether evidence is needed.

Communication should be accurate, authorised and timely. Paying a ransom does not guarantee recovery and may create legal, ethical or operational concerns. The appropriate response depends on law, insurance conditions, stakeholder safety, business continuity and the likelihood of restoring systems without payment.

Privacy and Responsible Data Governance

Privacy is not simply secrecy. It includes an individual’s ability to understand and exercise appropriate control over personal information. Personal data is information relating to an identified or identifiable person. Names, identification numbers, location data, online identifiers and some combinations of seemingly harmless attributes may qualify.

Responsible privacy practice commonly includes these principles:

• Purpose limitation: collect and use information for specified legitimate purposes.
• Data minimisation: collect only what is reasonably necessary.
• Transparency: explain what is collected, why, how long it is retained and with whom it is shared.
• Accuracy: keep information correct and provide methods for correction.
• Retention limitation: delete or anonymise data when it is no longer needed, subject to legal requirements.
• Security: apply safeguards appropriate to sensitivity and risk.
• Accountability: assign responsibility and maintain evidence of compliance.

Privacy law varies by jurisdiction, sector and type of information. Organisations must understand applicable requirements concerning lawful processing, consent, access requests, breach notification, cross-border transfers and sensitive data. Consent should not be treated as a universal solution: it must be informed and freely given where the law requires those conditions, and a business should not request excessive information merely because a user clicks “accept.”

Privacy by design integrates privacy considerations into systems from the beginning. Examples include collecting approximate rather than precise location, using pseudonymous identifiers, separating identity data from analytics, limiting employee visibility and applying short retention periods. Ethical data governance also asks whether a use is fair, expected and proportionate, even when it is technically legal.

Artificial intelligence intensifies privacy concerns because models may process large datasets, infer sensitive characteristics or expose information through poorly controlled prompts and outputs. Businesses should define permitted data inputs, restrict confidential information in public tools, assess vendor retention practices and require human review for high-impact decisions.

Third-Party and Supply-Chain Technology Risk

Organisations depend on cloud providers, payment processors, software vendors, managed security services, consultants and telecommunications companies. A supplier may have privileged access to data or systems, making it part of the organisation’s effective attack surface.

Third-party assessment should occur before contracting and throughout the relationship. Relevant questions include:

• What data and systems can the supplier access?
• Where are data stored and processed?
• How are identities, administrators and subcontractors controlled?
• What security testing, independent assurance or certifications are available?
• How quickly must incidents be reported?
• What are the RTO, RPO and service-level commitments?
• How are data returned or destroyed at contract termination?
• Can the organisation audit, suspend access or require remediation?

Contracts should define security responsibilities, breach notification, confidentiality, data ownership, subprocessor approval, availability targets, evidence requirements and exit assistance. A vendor certificate can be useful evidence but is not a complete risk assessment. Continuous monitoring, periodic reviews and reassessment after major changes are necessary.

The shared-responsibility model is particularly important in cloud computing. The provider may secure physical facilities and core infrastructure, while the customer remains responsible for identities, configurations, applications and data. Misunderstanding this division can produce exposed storage, excessive permissions or unprotected interfaces.

A Risk-Assessment Framework for Managers

Managers can use the following sequence:

1. Identify assets: systems, data, processes, people and services.
2. Classify importance: consider confidentiality, integrity, availability, legal sensitivity and business criticality.
3. Identify threats and vulnerabilities: use incident history, audits, technical assessments and staff knowledge.
4. Estimate likelihood and impact: use consistent categories and document assumptions.
5. Select treatments: avoid, reduce, transfer or accept the risk.
6. Assign ownership: name the person accountable for treatment.
7. Monitor and review: track changes, incidents, control performance and residual risk.

Risk transfer through insurance or a contract does not remove the underlying obligation to protect customers or maintain operations. Risk acceptance should be explicit, informed and approved at an appropriate level.

Illustrative Case: MetroMart’s Ransomware Incident

Background

MetroMart is a fictional regional retailer with 30 stores and an online ordering platform. Employees use cloud email, a point-of-sale system and a third-party logistics provider. The company has daily backups but has never performed a full restoration test.

Problem

An accounts employee receives a convincing supplier email and enters credentials into a fraudulent login page. The attacker uses the credentials to access email, persuades an employee to approve a new payment account and later deploys ransomware through a remote administration account. Store systems become unavailable, while the attacker attempts to delete connected backups.

Analysis

The threat is credential theft followed by unauthorised access and ransomware. Vulnerabilities include absent MFA for remote administration, excessive privileges, inadequate email verification, connected backups and insufficient monitoring. Impacts include lost sales, delayed supplier payments, possible exposure of personal data, investigation costs and reputational damage.

Response and Solution

MetroMart activates its incident-response team, isolates affected networks and disables suspected accounts. It preserves logs and communicates through a verified channel rather than the compromised email system. The company contacts its legal advisers, insurer, payment partners and relevant authorities as required. It restores critical services from an offline backup after verifying its integrity, resets privileged credentials and requires phishing-resistant MFA for administrators.

Longer-term improvements include least-privilege role design, payment approval separation, email authentication and filtering, immutable backups, quarterly restoration tests, supplier access reviews, tabletop exercises and employee training based on realistic simulations.

Outcome and Learning Points

The company resumes essential store operations within its target recovery time, but online ordering takes longer because the restoration process exposes undocumented dependencies. The case demonstrates that a security incident is also a continuity, privacy, financial-control and supplier-management event. MFA, backups and training are valuable individually, but their effectiveness depends on design, testing and integration.

Challenges and Limitations

No control is perfect. MFA can be bypassed through session theft or social engineering; encryption cannot protect data displayed to an authorised but dishonest user; backups can contain corrupted or infected files; monitoring can generate false alarms; and security policies may fail when they are impractical. Strong controls can also impose costs, reduce convenience or exclude users with accessibility needs.

Security decisions should therefore be proportionate and risk-based. Organisations should measure meaningful outcomes, such as time to detect, time to contain, restoration success, privileged-account coverage, patching timeliness and completion of access reviews. Metrics should support learning rather than encourage staff to conceal incidents.

Governance requires clear accountability. The board and senior managers set risk tolerance and allocate resources; technology professionals implement and monitor controls; process owners protect business information; and every employee has responsibilities concerning credentials, data handling and reporting.

Best-Practice Checklist

A business should, at minimum:

• Maintain an inventory of systems, data and suppliers.
• Use MFA, especially for administrators, remote access and sensitive services.
• Apply least privilege, separation of duties and prompt access removal.
• Patch supported systems and retire unsupported technology.
• Encrypt sensitive data in transit and at rest, with controlled key management.
• Maintain offline or immutable backups and test restoration.
• Establish, exercise and improve an incident-response plan.
• Collect personal data purposefully, transparently and minimally.
• Review suppliers before onboarding and throughout the contract.
• Train staff to identify phishing, social engineering and privacy risks.
• Record decisions, exceptions, incidents and lessons learned.

Chapter Summary

Cybersecurity, privacy and digital risk are interconnected dimensions of responsible business management. Threats create potential harm, vulnerabilities provide opportunities for exploitation, and controls reduce likelihood or impact. Effective protection uses defence in depth, combining policies, people, technology and physical safeguards.

Authentication establishes identity, while authorisation determines permitted actions. MFA, least privilege, separation of duties and access reviews reduce account-related risk. Encryption protects confidentiality and, through signatures and hashes, can support authenticity and integrity, but it depends on sound key management and does not replace other controls.

Backups, RPOs, RTOs, continuity planning and tested recovery arrangements limit operational disruption. Incident response coordinates preparation, detection, containment, eradication, recovery and learning. Privacy requires purposeful, transparent, proportionate and secure handling of personal data. Finally, suppliers and cloud providers must be assessed because outsourced technology remains part of the organisation’s risk environment.

Key Terms

Threat: A potential cause of harm to an asset or organisation.

Vulnerability: A weakness that a threat can exploit.

Risk: The possibility of harm arising from a threat exploiting a vulnerability.

Control: A safeguard that reduces risk likelihood or impact.

Authentication: Verification of a user’s or system’s identity.

Authorisation: Determination of what an authenticated entity may do.

Multi-factor authentication: Authentication using two or more different factor categories.

Least privilege: Granting only the access necessary for assigned duties.

Encryption: Transforming plaintext into protected ciphertext using a key.

Hash: A fixed-length digest used primarily for integrity checking.

Digital signature: A cryptographic mechanism supporting origin authentication and integrity.

Backup: A separate copy of data maintained for restoration.

RPO: The maximum acceptable period of data loss measured in time.

RTO: The target maximum time for restoring a service.

Business continuity: The capability to maintain critical operations during disruption.

Incident response: The organised process for managing and recovering from a security incident.

Personal data: Information relating to an identified or identifiable person.

Data minimisation: Collecting only information reasonably necessary for a defined purpose.

Least-need-to-know: Restricting information access to what a person needs for a particular task.

Third-party risk: Risk arising from suppliers, contractors or external technology services.

Review Questions

Short Answer Questions

1. Distinguish between a threat, vulnerability, risk and control.
2. Why is multi-factor authentication stronger than a password alone?
3. Explain the difference between RPO and RTO.
4. What is the purpose of data minimisation?
5. Identify the main stages of incident response.

Long Answer Questions

1. Explain how least privilege, separation of duties and access reviews work together to reduce organisational risk.
2. Compare symmetric and asymmetric encryption, including their practical uses and limitations.
3. Discuss why backups must be protected and tested rather than merely created.
4. Explain how privacy by design can influence the development of a business information system.
5. Evaluate the responsibilities of a business when using a cloud service provider.

Analytical / Application Questions

1. A company’s finance manager receives a request to change a supplier’s bank account by email. Analyse the risks and propose preventive, detective and corrective controls.
2. A hospital has an RPO of one hour and an RTO of four hours for its appointment system. Recommend an appropriate backup and recovery approach and explain the trade-offs.
3. A retailer discovers that a former employee’s account remained active for three months and was used to download customer records. Analyse the control failures, privacy implications and incident-response actions required.

Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes authentication from authorisation?

A. Authentication determines what a user may access, while authorisation verifies identity.

B. Authentication verifies identity, while authorisation determines permitted actions.

C. Authentication encrypts data, while authorisation creates backups.

D. Authentication detects malware, while authorisation restores systems.

Correct Answer: B. Authentication verifies identity, while authorisation determines permitted actions.

Question 2

Which control most directly applies the principle of least privilege?

A. Giving every employee administrator access for convenience

B. Allowing employees to access only the systems required for their duties

C. Storing all company data in one database

D. Sharing one password among a department

Correct Answer: B. Allowing employees to access only the systems required for their duties

Question 3

What is the main purpose of a salt in password storage?

A. To make passwords recoverable in plaintext

B. To increase network bandwidth

C. To make precomputed password attacks more difficult

D. To replace multi-factor authentication

Correct Answer: C. To make precomputed password attacks more difficult

Question 4

Which statement about encryption is correct?

A. Encryption alone guarantees data accuracy and availability.

B. Encryption transforms plaintext into ciphertext using a key.

C. Encryption and hashing are always reversible processes.

D. Encryption eliminates the need for access control.

Correct Answer: B. Encryption transforms plaintext into ciphertext using a key.

Question 5

An organisation with an RPO of two hours aims to ensure that restored data are no more than:

A. Two hours old relative to the disruption

B. Two days old relative to the disruption

C. Two minutes old relative to the disruption

D. Two weeks old relative to the disruption

Correct Answer: A. Two hours old relative to the disruption

Question 6

Which incident-response stage focuses on limiting the spread of an active attack?

A. Preparation

B. Containment

C. Lessons learned

D. Eradication

Correct Answer: B. Containment

Question 7

Which practice best reflects data minimisation?

A. Collecting every possible customer attribute for future use

B. Keeping all personal data indefinitely

C. Collecting only information necessary for a defined purpose

D. Sharing personal data with all suppliers

Correct Answer: C. Collecting only information necessary for a defined purpose

Question 8

Why are offline or immutable backups valuable against ransomware?

A. They guarantee that no employee can ever access data.

B. They reduce the attacker’s ability to alter or delete recovery copies.

C. They eliminate the need to test restoration.

D. They prevent all phishing messages.

Correct Answer: B. They reduce the attacker’s ability to alter or delete recovery copies.

Question 9

Which issue is especially important when assessing a cloud supplier?

A. Whether the supplier’s logo matches the customer’s logo

B. Which security responsibilities remain with the customer

C. Whether the supplier permits unlimited employee privileges

D. Whether contracts can omit incident reporting requirements

Correct Answer: B. Which security responsibilities remain with the customer

Question 10

A digital signature primarily helps provide:

A. Confidentiality by hiding all data from every party

B. Evidence of origin and detection of alteration

C. Physical protection for a server room

D. Automatic restoration from backup

Correct Answer: B. Evidence of origin and detection of alteration