Security as an organisational objective

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. Why do medium and large organisations treat protecting data and systems as an objective in its own right?

A A security failure can damage reputation, finances and the ability to operate

B Security only matters to the IT team and does not affect organisational goals

2. A retailer suffers a data breach and customers hear about it in the news. Which objective is most directly threatened?

A Increasing the number of office computers

B Reputation and customer trust

3. Which is a financial loss that can follow a security incident?

A Gaining extra profit because systems were offline

B Paying for recovery, ransom demands or fines

4. A ransomware attack locks all of a company's servers for a week. Which objective is mainly at risk?

A Business continuity

B Legal compliance only

5. Which statement about security and legal compliance is correct?

A Weak security can lead to breaking privacy laws and facing penalties

B Laws apply only to the software, so the organisation faces no penalty

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1security objective		AA goal to protect data and systems, because a failure can harm an organisation's reputation, finances and ability to operate
2business continuity		BObjective: Protect customer data to maintain customer trust
3A data breach can cause customers to lose trust in an organisation, so protecting their data is an objective that safeguards its reputation		CObjective: Prevent incidents to avoid fines, legal costs and lost revenue
4Security failures can lead to financial loss and legal penalties, so the organisation sets a goal to meet its compliance and cost-saving needs		DThis ignores that an incident causes financial loss, damages reputation and can stop operations, so protecting data and systems early is cheaper than recovering afterwards.
5Objective: Security is only an IT task, so it is not part of the organisation's goals		EKeeping critical systems running, or restoring them quickly, so the organisation can still operate after a security incident
6Objective: Spend nothing on security because incidents only cost money when they happen		FSecurity is an organisational objective in its own right, not just a technical task. A failure harms reputation, finances and operations, so it belongs among the organisation's goals.

Definitions

security objective

Fill in the Blanks

Complete each line of code by filling in the missing parts.

IF breach = TRUE THEN trust ← trust _ 20 END IF

IF incident = TRUE THEN profit ← profit - ____ END IF

IF ransomware = TRUE THEN operating ← _____ END IF

IF ___ compliant THEN PRINT "Risk of penalty" END IF

IF trustLost __ moneyLost THEN PRINT "Security is an objective" END IF

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A trust = 100

B if breach_occurred:

C trust = trust + 20

D print(trust)

Question 2

A revenue = 50000

B fine = 10000

C recovery_cost = 5000

D loss = fine - recovery_cost

E profit = revenue - loss

Question 3

A system_up = True

B if ransomware_hit

C system_up = False

D print(system_up)

Question 4

A function report_breach(leaked):

B if leaked:

C notify_regulator()

Question 5

A objectives = []

B objectives.append('profit')

C objectives.append(security)

D print(len(objectives))

Answer Key

Security as an organisational objective

Section A: Quick Questions

A — A security failure can damage reputation, finances and the ability to operate

B — Reputation and customer trust

B — Paying for recovery, ransom demands or fines

A — Business continuity

A — Weak security can lead to breaking privacy laws and facing penalties

Section B: Match the Pairs

security objective → A goal to protect data and systems, because a failure can harm an organisation's reputation, finances and ability to operate

business continuity → Keeping critical systems running, or restoring them quickly, so the organisation can still operate after a security incident

A data breach can cause customers to lose trust in an organisation, so protecting their data is an objective that safeguards its reputation → Objective: Protect customer data to maintain customer trust

Security failures can lead to financial loss and legal penalties, so the organisation sets a goal to meet its compliance and cost-saving needs → Objective: Prevent incidents to avoid fines, legal costs and lost revenue

Objective: Security is only an IT task, so it is not part of the organisation's goals → Security is an organisational objective in its own right, not just a technical task. A failure harms reputation, finances and operations, so it belongs among the organisation's goals.

Objective: Spend nothing on security because incidents only cost money when they happen → This ignores that an incident causes financial loss, damages reputation and can stop operations, so protecting data and systems early is cheaper than recovering afterwards.

Section C: Definitions

security objective — A goal to protect data and systems, because a security failure can damage an organisation's reputation, finances and ability to keep operating.

Section D: Fill in the Blanks

IF breach = TRUE THEN
  trust ← trust - 20
END IF

IF incident = TRUE THEN
  profit ← profit - cost
END IF

IF ransomware = TRUE THEN
  operating ← FALSE
END IF

IF NOT compliant THEN
  PRINT "Risk of penalty"
END IF

IF trustLost OR moneyLost THEN
  PRINT "Security is an objective"
END IF

Section E: Spot the Error

C — A data breach damages customer trust, so trust should go down. The line should be trust = trust - 20.

D — The total financial loss from an incident is the fine plus the recovery cost added together. The line should be loss = fine + recovery_cost.

B — The if statement is missing its colon at the end. It should be if ransomware_hit: so the ransomware case can stop the system running.

A — Python defines a function with the keyword def, not function. It should be def report_breach(leaked): so the program can handle a legal compliance duty.

C — The word security needs quotes because it is a string. Without quotes Python treats it as an undefined variable. It should be objectives.append('security').