“A customer-data-breach bowtie: the hazard is customer data in production systems and the top event is unauthorised access. Show phished credentials, application vulnerabilities and over-privileged accounts as threats, with MFA, training, patching, a firewall, access reviews and session controls as barriers. Show data disclosure, customer impact and service disruption with detection, revocation, incident response, notification, recovery and continuity barriers.”
Entenda as decisões por trás dele.
Identify the protected data asset.
Focus on unauthorised access.
Separate identity and application controls.
Include detection and response actions.
Use to structure a cybersecurity risk discussion, then map controls to the organisation's security programme.
Dúvidas comuns
Why is unauthorised access the top event?
It is the loss of control that can occur before data is disclosed or other impacts follow.
Where do monitoring controls go?
Detection controls usually reduce consequences after access and belong on the right side.
Can supplier risk be included?
Yes. A supplier compromise can be added as a threat with contractual and technical barriers.