BUSI2001 Chap.10 Cybersecurity Risks and Assessment
Cybersecurity Risks and Assessment
Cybersecurity is treated in the course as a business imperative, because attacks can halt operations, expose data and damage a brand. This chapter maps the main threats, from ransomware and phishing to insiders and social engineering, and the actors behind them. It sets out the course's five-element critical thinking model, the three families of technical, administrative and physical controls, and multi-factor authentication.
Using the final workshop's CyberGuard Solutions scenario, it redesigns access after a credential breach and scores weaknesses in a physical layout by likelihood and impact so the largest gaps are fixed first. Practice covers control classification, MFA design and a convincing payment request from a fake executive.
The emphasis throughout is on judgement: deciding which risks matter most and defending that ranking with evidence.
What this chapter covers
- 01
Threats and threat actors
- 02
Critical thinking model
- 03
Technical controls
- 04
Administrative controls
- 05
Physical controls
- 06
Multi-factor authentication
- 07
Risk prioritisation
- 08
Social engineering
Worked example · free
Classifying authentication factors for an MFA redesign
- +1A password is something you know.
- +1A smart card and a code on a registered phone are both something you have.
- +1A fingerprint scan is something you are.
- +1Valid MFA combines two different categories, such as smart card plus PIN or password plus fingerprint.
Key terms
- Social engineering
- Manipulating people into revealing information or granting access instead of attacking systems directly.
- Ransomware
- Malware that encrypts or locks an organisation's data and demands payment to restore it.
- Insider threat
- A security risk that comes from people inside an organisation, whether malicious or careless.
- Administrative control
- A security policy or procedure, such as access reviews or training, rather than a technical mechanism.
- Physical control
- A security measure that restricts access to places or devices, such as locks and badges.
- Threat actor
- A person or group, such as a criminal gang or nation-state, that carries out or sponsors attacks.
Cybersecurity Risks and Assessment FAQ
What are the five elements of the cybersecurity critical thinking model?
The model joins five things: how a person thinks, their technical skill, their interpersonal skill, their theoretical knowledge and their broader intellectual ability. Together they let professionals analyse threats, question assumptions and develop strategic defences. Technical knowledge alone is not enough, because many attacks succeed through people and processes rather than technology.
Why does a credential breach call for MFA?
When a password is stolen, any system protected only by that password is open. Multi-factor authentication adds evidence of a different kind, such as a device or a biometric, so the stolen password alone no longer grants access. The strength of the combination should rise with the sensitivity of the resource.
Which cyberattack cases does the topic use?
The reading list includes the 1.5 billion dollar Bybit hack, the Colonial Pipeline and WannaCry ransomware attacks, the Optus data breach and the 2020 Twitter hack. Read each for how the attacker got in, which control failed and what the business impact was, then reuse those lessons in your own risk assessments.
Why are physical controls part of cybersecurity?
Digital systems sit on physical hardware in physical buildings. An unlocked back door, an unattended visitor or an unlocked server room can give an attacker direct access that bypasses network defences entirely. The final workshop therefore reviews CyberGuard's reception, workspaces, server rooms, file storage and car park alongside its access controls.
Assessment move
Prepare this topic through scenarios. Take the CyberGuard description from the final workshop and list every resource and every existing control, sorting the controls into technical, administrative and physical families so gaps become visible. Draft an MFA design that matches factor strength to the value of each resource, then test it against two attacks: a stolen password and a convincing phishing email.
For the physical layout, score each weakness for likelihood and impact, rank them, and write the observation beside each score so a reader can challenge your judgement. Read at least two of the listed cases and summarise each in three lines: entry point, failed control, business impact.
Use the three debate scenarios on privacy, convenience and regulation to practise arguing a trade-off clearly, and record in your portfolio how the class debate changed your view. Finish by writing a one-page security memo for a small business you know, recommending three controls in priority order with a reason for each. It rehearses the evaluation and recommendation skills that the topic's learning outcomes describe.
Working through Cybersecurity Risks and Assessment in BUSI2001? Sia is AskSia’s AI Business Analytics tutor — ask any BUSI2001 Cybersecurity Risks and Assessment question and get a clear, step-by-step explanation grounded in how BUSI2001 is taught and assessed. Read this chapter free, then take your hardest questions to Sia.