Managing Risk and Defense in Depth

The risk assessment lesson found and rated a board game company's risks. This lesson starts from another company's assessed risks, chooses what to do about each, and then builds layers of protection around its most sensitive asset.

The organization is a family-run relocation company. Its customer database holds home addresses, relocation dates, and inventories of valuables. Together they tell a burglar where the valuables are and when each family is away. The company also runs a storage warehouse for customers' goods and a fleet of trucks with a GPS dispatch system. The table below lists five risks from its assessment.

Once a risk has been identified and assessed, an organization has four options: avoid it, transfer it, mitigate it, or accept it.

The license scan confirms who is paying, and after signing it has no further use. So the owners stop keeping scans. The office checks each license in person and deletes the old files. With no scans stored, the risk in that row is gone.

The other risks can't be avoided. Hauling goods, storing them between homes, and knowing where and when each job happens are the company's purpose. Stopping them would stop the business.

So the owners handle the trucks another way. They buy an insurance policy on the trucks and the goods they carry. If a truck is stolen, the insurer pays for the truck and its load. The policy adds no lock, so a theft is as likely as before. The insurer now bears most of the cost, though the deductible stays with the company.

The warehouse is handled with controls instead. It gets stronger locks and an alarm. The stronger locks lower the likelihood of a theft, since a burglar needs more time and tools to break one. The alarm lowers the impact of a theft that happens anyway. It alerts the owners when a door is forced, so the burglar has minutes instead of a night.

The dispatch system gets a control too, and there the question is price. Two were quoted against its expected loss of 6,000 dollars a year. A second sign-in step, a code from an app on the dispatcher's phone, costs 1,300 dollars a year. A private dispatch server, run by a hired contractor, costs 27,000 dollars a year.

The sign-in step, at 1,300 dollars a year, is well below the 6,000 it guards against, so it's cost effective. It's also easy to run: the dispatch service switches it on, and its only upkeep is enrolling a new dispatcher's phone. The private server isn't cost effective even if it stopped every attack. Its 27,000 dollars is 4.5 times the most it could save, and the family has no one to manage a contractor. The owners turn it down.

Locks and an alarm can't stop every theft from the warehouse. A burglar can break a lock and load goods in the minutes before anyone arrives. By day the loading doors stand open while crews work, and the alarm is off. Some risk remains after the mitigation, and since no further purchase brings it to zero, the owners accept it.

The customer database is the last row, and the one a burglar would value most. Its threats differ in kind. Training does nothing against a thief who carries off the server, and a lock does nothing against a phishing email. So the company puts a control on each of six layers, each chosen for a threat of its own.

A phishing email reaches one crew member, who types a password into a fake sign-in page. The human layer is bypassed. The adversary tries the password from a home computer, and the firewall refuses the connection, since it comes from neither the office network nor a tablet's VPN.

Suppose the adversary did reach the office network. A crew account shows that day's three jobs and can't export, so the damage would stop there. The firewall and that account limit make the defense resilient, since each still holds with the human layer bypassed.