From Assets and Threats to Business Impact

Start with business impact, not the attack name

Cybersecurity in business is not a list of attack names or a set of technical tools detached from the organization. The starting point is what the organization needs to preserve: a digital service customers depend on, data needed for decisions, employees' ability to work, reputation, revenue, a contractual commitment, or continuity of an important process. We call something of value that needs protection an asset. An asset may be information, a system, a service, a device, an account, a process, or a third-party relationship. Once the asset is clear, we can ask what might happen to it, who or what could cause that event, what weakness might enable it, and finally what business impact makes the risk worth prioritizing.

In this diploma we use five terms in a practical way. A threat is a circumstance, actor, or event that can cause harm. A vulnerability or weakness is a condition a threat can exploit, such as a poor configuration, a weak process, or excessive dependence on one person. Cybersecurity risk is the possibility that the interaction of a threat and a weakness around a valuable asset leads to an unwanted impact. A control is an action, mechanism, or practice intended to change risk: prevent an event, detect it sooner, reduce its impact, or improve recovery. These are working teaching definitions, not an attempt to impose one universal vocabulary on every professional framework.

Confidentiality, integrity, and availability as business-impact lenses

Three common objectives help describe what can be harmed. Confidentiality means information is not disclosed to people who are not authorized to receive it. Integrity means preserving the correctness of information or systems and preventing unauthorized alteration. Availability means information or a service can be used when needed. Memorizing the acronym is not enough; each objective must be translated into business impact. Exposure of a customer list may harm confidentiality, changing an account number in a payment record harms integrity, and an order platform outage during peak demand harms availability. One incident may affect more than one objective at the same time.

NIST CSF 2.0 provides a broader view of cybersecurity outcomes through six connected Functions: Govern, Identify, Protect, Detect, Respond, and Recover. For a manager or business owner, this prevents security from being reduced to “protection” alone. An organization may need to understand what it has and depends on, protect what matters, detect problems, respond, recover, and place all of that within governance that defines decisions and responsibilities. The Framework provides high-level outcomes usable by different organizations, but it does not choose an organization's priorities or detailed controls for it.

From describing a problem to an actionable risk statement

A practical risk statement contains four parts: an important asset or activity, an event or threat, a weakness or enabling condition, and a business impact. Add context when useful, but avoid false precision. Do not assign a numerical probability without supporting data. Also distinguish a present issue from a possible future risk. “Backups have not been tested for a year” is an observed condition or weakness; the risk is what could happen to the business if recovery is needed and the backup is unusable. This distinction helps later when assigning an owner, control, and target date.