KIRIRI WOMEN’S UNIVERSITY OF SCIENCE AND TECHNOLOGY
Week 1: Introduction to Cybersecurity Risk
1. Introduction
Cybersecurity refers to the practice of protecting systems, networks, and programs from digital
attacks. These attacks are usually aimed at accessing, changing, or destroying sensitive
information; extorting money from users; or interrupting normal business processes.
2. Importance of cybersecurity
By implementing cybersecurity measures, organizations can identify vulnerabilities and mitigate
threats to ensure the confidentiality, integrity, and availability of their data and systems. In
today's interconnected world, where data is a critical asset, cybersecurity is essential for
protecting businesses and individuals from financial loss, reputational damage, and operational
disruption.
3. Risk, Threat, and Vulnerability
Threat: A potential cause of an unwanted incident that may result in harm to a system or
organization. Threats are external to your organization and cannot be controlled.
o Examples: A disgruntled employee, a malware infection, a natural disaster, a
hacker group.
o Analogy: A hurricane is a threat to a coastal city.
Vulnerability: A weakness in an asset or control that a threat could exploit.
Vulnerabilities are internal to your organization and can be mitigated.
o Examples: Unpatched software, a weak password policy, an unsecured server
port, a lack of employee cybersecurity training.
o Analogy: A leaky roof on a house is a vulnerability to the hurricane threat.
Risk: The potential for loss or damage when a threat exploits a vulnerability. Risk is a
function of a threat's likelihood and the impact of its successful exploitation.
o Formula: Risk = Likelihood x Impact
o Analogy: The risk of water damage to your furniture is high if a hurricane (threat)
hits a house with a leaky roof (vulnerability).
4. The CIA Triad
The CIA Triad is a foundational model for cybersecurity, guiding security policy and controls.
DSE 1005: CYBERSECURITY RISK ASSESSMENT Page |1
KIRIRI WOMEN’S UNIVERSITY OF SCIENCE AND TECHNOLOGY
Confidentiality: The principle that data is accessible only to authorized individuals. This
prevents unauthorized disclosure of information.
o Controls: Encryption, access control lists (ACLs), multi-factor authentication.
o Breach Example: A data leak of customer credit card numbers.
Integrity: The principle that data is trustworthy, accurate, and has not been altered or
destroyed by unauthorized parties.
o Controls: Hashing, digital signatures, version control.
o Breach Example: A hacker changing the price of an item on an e-commerce
website.
Availability: The principle that systems and data are accessible to authorized users when
needed.
o Controls: Redundancy, load balancing, denial-of-service (DoS) attack protection.
o Breach Example: A server crashing, making a website inaccessible to customers.
Class Activity
Scenario:
You are a cybersecurity analyst for a small online bookstore. The bookstore's website runs on an
older version of WordPress, which has not been updated in over a year. The website handles
customer orders, but all payment processing is outsourced to a third-party service. The company
has a single IT administrator who is responsible for all systems and a team of five employees
who manage book inventory and customer service. The IT administrator has a strong password,
but other employees use simple, easily guessed passwords.
Task:
1. Identify at least one threat to the bookstore's website.
2. Identify at least one vulnerability in the bookstore's system.
3. Based on your findings, identify and describe a specific risk.
4. Explain how this risk impacts the bookstore in terms of the CIA Triad.
DSE 1005: CYBERSECURITY RISK ASSESSMENT Page |2