Digital Risk Management & Cyber Resilience –
Study Notes
Simplified summary based on the lecture slides by Ayesha Rafiq.
1. What is Digital Risk?
Digital risk means the chance of something bad happening because of how an organization uses
technology, data, and the internet. It can affect three things: confidentiality (keeping data private),
integrity (keeping data accurate and unaltered), and availability (making sure systems and data
are accessible when needed).
Main types of digital risk:
• Cybersecurity Risk – Danger from hackers, malware, and data breaches.
• Compliance Risk – Problems caused by not following laws/regulations, leading to legal
penalties.
• Operational Risk – Risk of system failures that disrupt normal business operations.
• Third-Party Risk – Risks coming from vendors or partners in the supply chain.
2. Cyber Threat Landscape (Common Attacks Today)
• Ransomware – Malware that locks/encrypts your files and demands money to unlock them.
Over 4,000 attacks happen every day worldwide.
• Phishing – Fake emails or websites tricking people into giving away passwords. Around 90%
of all data breaches start this way.
• DDoS Attacks – Flooding a website/server with huge traffic to crash it. More than 15 million
such attacks happened in 2023.
• Insider Threats – Employees (on purpose or by mistake) leaking data. About 34% of breaches
come from inside the organization.
• Zero-Day Exploits – Attacks using software bugs that nobody has discovered or patched yet.
84 such bugs were exploited in 2023.
• Supply Chain Attacks – Hackers attack a trusted vendor's software/hardware to reach many
companies at once. These attacks have tripled since 2020.
3. Risk Management Framework (4 Steps)
This is a continuous cycle organizations follow to manage digital risk:
• Identify – Make a list of all assets (devices, data, systems), find possible threats, scan for
weaknesses, and keep a 'risk register' (a record of known risks).
• Assess – Estimate how likely each risk is to happen and how much damage it could cause.
Use a scoring matrix to rank risks by priority.
• Mitigate – Take action to reduce risk: apply security controls, install patches/updates, control
who can access what, and use encryption.
• Monitor – Keep watching systems continuously, use tools like SIEM (security monitoring
software), have an incident response plan ready, and do regular audits.
4. Cyber Resilience Strategy
Cyber resilience means being ready not just to prevent attacks, but also to survive and recover
from them. It has four parts:
• Anticipate – Predict risks before they happen using threat intelligence, red teaming (simulated
attacks), and penetration testing (ethical hacking to find weaknesses).
• Withstand – Build strong defenses such as firewalls, Multi-Factor Authentication (MFA),
zero-trust architecture (never automatically trust any user/device), and network segmentation
(dividing networks into smaller, isolated parts).
• Recover – Have business continuity plans, disaster recovery plans, regular backups, and
clear recovery time goals (RTO = Recovery Time Objective, RPO = Recovery Point Objective).
• Adapt – Learn from past incidents and continuously improve security measures.
5. Best Practices & Frameworks
Important Industry Frameworks (standards organizations follow):
• NIST CSF – A framework with 5 functions: Identify, Protect, Detect, Respond, Recover.
• ISO 27001 – An international standard for managing information security.
• MITRE ATT&CK; – A knowledge base describing how attackers operate (their tactics and
techniques).
• CIS Controls – A list of 20 key security controls ranked by how much impact they have.
Key Best Practices to Follow:
• Use Multi-Factor Authentication (MFA) for logins.
• Apply security updates and patches regularly.
• Train employees to recognize security threats (security awareness training).
• Run regular vulnerability assessments and penetration tests.
• Take automated backups and test that they actually work for recovery.
• Use Zero Trust Network Architecture (ZTNA) – verify everyone, trust no one by default.
• Have an incident response plan and practice it with drills.
• Manage risks from vendors and third parties carefully.
6. Real-World Case Studies
• SolarWinds (2020) – Supply Chain Attack: Hackers secretly inserted malware into
SolarWinds' software updates, which were then downloaded by 18,000+ organizations,
including US government agencies. Lesson: Always check third-party software carefully and
secure your software supply chain.
• Colonial Pipeline (2021) – Ransomware: A ransomware attack (DarkSide) forced the largest
fuel pipeline in the US to shut down, causing fuel shortages on the East Coast. Lesson: Keep
operational technology (OT) and IT networks separate, keep offline backups, and have a
tested incident response plan.
• Microsoft Exchange (2021) – Zero-Day Exploit: Hackers used four previously unknown
vulnerabilities to break into over 250,000 servers worldwide. Lesson: Apply patches quickly
and actively hunt for threats before they cause damage.
7. Key Takeaways (Summary)
• Digital risk management is essential, not optional, for every business.
• Cyber resilience means preparing to recover from failures, not just trying to prevent them.
• Use established frameworks like NIST and ISO 27001 to guide your security approach.
• People can be your biggest weakness (through mistakes) or your strongest defense (through
awareness).
• Keep monitoring and adapting continuously to stay ahead of new threats.