Implementation of Cybersecurity

How Much We Risk

Expected lecture date WS 2026: Oct 6

HTML · Slides · PDF

Cyril Klimeš, Tomáš Pitner tomas.pitner@mendelu.cz

Module Summary

ISMS: what it is and why, the PDCA cycle (Plan–Do–Check–Act), SMART objectives, ISMS documentation.
Information security policy: components of information security, policy levels, structure of the policy document.
Risk management: the ISO/IEC 27005:2022 process, its place in the ISMS cycle, the procedure of risk analysis.
Vulnerabilities and threats: types of threats, vulnerability examples, threat vs. risk vs. attack vs. impact.

Attacks: intentional attacks, types and strength of attacks, attacks against data communication.
Risk estimation: likelihood and impact, ISO/IEC 27005:2022 terminology (EN–CZ–ISO), acceptable costs of protection.
Case study (WEB-SHOP): a complete worked risk analysis — asset valuation, R = T × A × V, risk levels, and controls.
Core questions of risk management and where they belong in the individual PDCA phases.

Information Security Management System (ISMS)

What is ISMS

Information Security Management System (ISMS) ISO 27001:2022 is a framework of policies, procedures, guidelines, associated resources and activities to achieve the stated objectives of an organization.

It is based on the PDCA cycle (Plan-Do-Check-Act) and on the risk management approach of the information and communication system.
It specifies how to establish, implement and operate, monitor and review, maintain and improve information and data security, following the international standard ISO/IEC 27001:2022 ISO 27001:2022.

PDCA cycle (Plan - Do - Check - Act)

PDCA Model for Information Security Management ISO 27001:2022

Plan: Policy, Risks

Establish the framework, scope, risk approach, and controls

Information Security Management Systems (ISMS) scope definition
Identify relevant legal, regulatory, and contractual requirements
ISMS policy definition
Definition of the risk assessment approach
Identification of risks
Risk assessment
Identification and assessment of conditions for risk treatment

Figure 1. Plan

Plan: Measures

Security measures

Selection of security measures and their objectives
Preparation of the SOA (Statement of Applicability) document
Obtain management approval and commitment
Identification of all selected measures
Justification for the choice (positive and negative) in the light of the risk assessment
Follows up on the results of the risk assessment and countermeasure implementation plan

Plan: Document

Document countermeasures

Document the selected countermeasures (existing and planned) to cover the risks (mitigation, elimination, acceptance) and the rationale for the selection (according to ISO/IEC 27002:2022) ISO 27002:2022

Dates for implementation

Determines the dates for the implementation of the planned measures
Separate document only in case of subsequent certification or for large IS of large organizations

Do

Policies & Risk treatment

Implement and operate security policies and controls
Carry out the risk treatment plan (technical, organizational, administrative measures)
Establish organizational structure, roles, and responsibilities
Conduct training and awareness programs for staff

Figure 2. Do

Do: Processes, Communication

Operational processes and procedures

access control management
change management
incident management
backup and recovery

Communication

Ensure internal and external communication

Asset operation

Operate and manage information assets according to their classification

Check

Monitoring

Implementation of monitoring
Regular reviews of the effectiveness of the ISMS
Review of the level of acceptable and residual risks
Performing internal ISMS audits
Managing reviews of effectiveness and risk levels
Keeping records of events and incidents with an impact on the ISMS

Figure 3. Check

Act

Implement if the changes have led to success
Improving ISMS
Corrective action
Determining the scope of the ISMS in the organisation
ISMS Basic Policy

Figure 4. Act

Act: Risk analysis

Update risk analysis:

Risk assessment
Definition and description of the risk assessment approach
Identification and valuation of assets
Identification of risks
Risk analysis

Act: Countermeasures

Update countermeasures:

Proposal for countermeasures
Objectives of measures and safety measures to manage risks
Acceptance of risks
Declaration of support by the management of the organisation for the implementation and operation of the ISMS
Declaration of applicability

Documents Required for ISMS Implementation

Determination of the scope of the ISMS within the organization
Basic ISMS policy
Risk assessment

Documents Required for ISMS Implementation (2) Risk Assessment

Definition and description of the risk assessment approach
Identification and evaluation of assets
Identification of risks
Risk analysis
Design of countermeasures
Objectives and security controls for risk treatment
Risk acceptance

Documents Required for ISMS Implementation (3)

Management statement of support for the implementation and operation of the ISMS
Statement of Applicability (SoA)

Management statement — a declaration by top management that it approves the ISMS and commits to its implementation and operation.

Statement of Applicability (SoA) — the list of the security controls selected on the basis of the risk assessment, together with the justification for their selection and for excluding any controls of Annex A of ISO/IEC 27001:2022; it is a mandatory output of the ISMS.

ISMS Build-Up

Procedure for the design and implementation of the ISMS — determining the scope of the ISMS, the ISMS policy, the risk assessment, the Statement of Applicability, and the implementation of the selected measures.
Feedback enabling continual improvement of the ISMS — the results of monitoring, internal audits, and the evaluation of effectiveness are fed back into the next Plan phase.

Figure 5. ISMS Build-Up

The build-up of the ISMS is the Plan—Do—Check—Act cycle applied to the whole management system: each pass through the loop widens the scope and improves the set of measures.

Maintaining the Security Attributes of Information at the Required Level

Fundamental objective of the ISMS — keeping the security attributes of information at a defined level.

Security attribute	What is maintained
Confidentiality	information is not disclosed to unauthorized subjects (the CIA triad is defined in module 01)
Integrity	information is accurate, complete, and protected against unauthorized modification
Availability	information and related services are accessible to authorized subjects when required
Authenticity	the origin of the information is genuine and verifiable
Reliability	the information and the processing that produced it are trustworthy and consistent
Provability of origin	it can be proven who created and sent the information (non-repudiation of origin)
Provability of receipt	it can be proven that the information was delivered and received (non-repudiation of receipt)

Security attribute

What is maintained

Confidentiality

information is not disclosed to unauthorized subjects (the CIA triad is defined in module 01)

Integrity

information is accurate, complete, and protected against unauthorized modification

Availability

information and related services are accessible to authorized subjects when required

Authenticity

the origin of the information is genuine and verifiable

Reliability

the information and the processing that produced it are trustworthy and consistent

Provability of origin

it can be proven who created and sent the information (non-repudiation of origin)

Provability of receipt

it can be proven that the information was delivered and received (non-repudiation of receipt)

Information must be protected in the context of the fundamental security objectives at a defined level.

Determination of ISMS objectives

ISMS objectives must be SMART

S - Specific	as precise as possible to make it clear what is meant by the objective.
M - Measurable	to assess the extent to which the objective has been met.
A - Accepted	accepted by the responsible person.
R - Realistic	realistic so that it can be achieved in real time.
T - Timed	timed to make it clear when the goal is to be met.

Examples of SMART goals

Percentage reduction in the number of workstation infections caused by the user (antivirus solutions on workstations, mail servers and user education).
Preventing information leakage (proper deployment of DLP (Data Loss Prevention).
Speeding up system recovery time after a failure (business continuity solutions).
Streamlining and accelerating the resolution of security incidents (deploying a security incident management environment).

Other activities related to ISMS

Risk assessment,
Security policy making,
ISMS monitoring,
Change management,
Control and audit
Evaluating the effectiveness of the ISMS

Risk assessment

Procedure for identifying potential security risks and determining their values
Example: cyber attack on a server Information Security Policy

Risk assessment of cyber-attack

Table 1. Risk assessment of cyber-attack
Category	Description
Risk identification	Cyber-attack on Webserver
Probability	4 (high)
Impact	5 (very high)
Total risk score	20 =4*5
Countermeasures	setup advanced firewalls, regular updates

Risk assessment of cyber-attack (2)

Table 2. Risk treatment
Category	Description
Risks	Identification of risks
Responsible person	IT security team
Countermeasures	Design of countermeasures
State	in progress

Information Security Policy

defines:

Purpose and scope
Roles and responsibilities
Security measures
Incident Management
Monitoring and review

Information Security Policy

IT Security Policy (ISP) is the fundamental document of information security.
ISP is a set of technical and administrative measures and procedures, serving to maintain the defined level of security.
It is developed based on a risk analysis (RA).

Components of IS covered

Components of the IS covered by the ISP = assets:

Hardware (computers, servers, printers),
Software (operating systems, applications),
Telecommunication and network equipment (routers, switches, cabling, …)

People

employees including system and network administrators,
customers or clients,
business partners, etc.

Components of IS covered

Processes

workflows,
activities,
services, …

Data

enterprise information in different stages of processing:
input reports, databases, transmitted data packets, output reports, …

Security Policy and Security Documentation

Decree No. 409/2025 Coll., Sections 3(d) and 6 (management of the security policy and security documentation)

Security Policy

A set of principles and rules that determine how assets are protected (Section 2(d))
States the main principles, the objectives of the ISMS, the security needs and the rights and obligations related to information security management
Long-term, independent of current ICT, in line with the strategic direction of the organization

Security Documentation

Detailed documentation for the individual security measures (Sections 3 to 27) — e.g. asset, risk, supplier, human resources, change and access management, incident handling, continuity, physical and network security, cryptography
Derived from the security policy, the security needs and the results of the risk assessment
Dynamic — reviewed regularly, kept up to date and reflected in operational documentation, rules and procedures

The security policy and documentation must be managed so that they are

available in electronic or paper form,
brought to the attention of the persons concerned,
adequately accessible to them,
protected in terms of confidentiality, integrity and availability, and
complete, legible, easily identifiable and searchable.

The security policy and documentation cover, among other things

monitoring and auditing: continuous and subsequent monitoring of the effectiveness of the information security system,
the recovery plan and
the emergency plan.

ISMS monitoring

Regular auditing
Incident tracking
Control of recovery plans
Tracking changes
Employee education and awareness
Risk analysis

Change Management

What is Significant change:

may have an impact on cyber security
poses a high risk regardless of the measures already in place
E.g. change of configuration, functionality, major supplier
Significant changes need to be managed.

ISMS control and audit

a tool to ensure effective improvement of the established ISMS
highlighting any deviations from best practice

Evaluating the effectiveness of the ISMS

Assessment of the status of the ISMS, including a review of the risk assessment,
assessing the results of audits performed and the impact of cyber security incidents on the defined scope of the ISMS.

ISMS updates

Based on the results of the evaluation of the effectiveness of the ISMS, the findings of audits and in connection with significant changes, the ISMS and the relevant documentation must be updated.

"Information Security Policy" document

Information security objectives and principles
Legislative framework
Scope of the information management system

Implementation of ISMS:

CS committee,
CS manager,
CS architect,
CS auditor,
asset guarantor,
RACI matrix

"Information Security Policy" document (2)

Information security management processes and principles: asset classification and management, asset evaluation criteria, human resource management, physical security management, preventive and corrective action management, communications and operations security management, access management, systems development and maintenance, business continuity management, information security compliance, information security responsibilities, reviews and audits

Risk Management

Core Questions of Risk Management ISO/IEC 27005:2022

What can happen? (Risk identification – identifying potential events or threats)
What is the likelihood that it will happen? (Risk analysis – estimating probability/likelihood)
What are the consequences if it happens? (Risk analysis – estimating impact/consequences)
What can we do about it? (Risk treatment – selecting and implementing measures)
What are the costs, benefits, and risks of each option? (Risk evaluation – comparing options and making decisions)

Risk Analysis: Terms

Asset	anything that has value for the company and should be protected accordingly
Threat	any event that could cause a breach of the confidentiality, integrity, and availability of an asset
Vulnerability	a property of an asset or a weakness in physical, logical, or administrative security that could be exploited by a threat.
Risk	the probability that a threat will exploit a vulnerability and cause a breach of confidentiality, integrity, or availability.
Countermeasure	a measure at the physical, logical, or administrative security level that reduces vulnerability and protects an asset from a given threat

Risk Analysis: Types of Threats

Physical	Natural influences HW failure Power outage
Software	External SW errors
People Internal	Intentional Unintentional External

Risk management process ISO/IEC 27005:2022

Risk management in the ISMS process

Risk Analysis

Risk Analysis is a key step in building an ISMS.

Key Questions of Risk Analysis

What will happen if the information is not protected? (impact on IS)
How can information security be compromised? (possibility of exploiting a vulnerability by a threat — carrying out an attack)
What is the probability of this happening? (degree of risk)

Vulnerabilities

Vulnerability is a property of an IS (imperfection of the IS or its components).
Principle: there is no IS without vulnerabilities.

Occurrence of vulnerabilities:

HW
SW
Operating environment
People (employees and other authorized users)

The goal of RA

to identify vulnerabilities
to determine the acceptable level of risk resulting from the existence of vulnerabilities
to determine how to keep risks at an acceptable level

Examples of Vulnerabilities

Inadequate maintenance of the information and communication system,
obsolescence of the information and communication system,
inadequate protection of the external perimeter,
inadequate security awareness of users and administrators,
Inappropriate access rights settings,
Inadequate procedures for identifying and detecting negative security phenomena, cyber security events and cyber security incidents.

Threat, Risk

Threat: (primary, non-derived phenomenon) creates the possibility of exploiting a vulnerability
Risk: is the probability of exploiting a vulnerability (probability of a threat occurring)

Attack, Impact

Attack

(security incident) is the exploitation of a vulnerability.
Intentional attack (subjective attack)
Unintentional attack (objective attack)

Attack targeted to specific security attribute

Interruption	against availability
Eavesdropping	against confidentiality
Change	against integrity
Forgery (falsification)	against authenticity

Threat

Consequence of IS vulnerability

Possibility of exploiting vulnerability
Creates a risk of attack

Objective threat

arises from the environment
natural, physical
physical
technical, logical

Subjective threat

arises from human action
intentional
unintentional

What Characterizes a Threat

Frequency: criticality of application (for both objective and subjective threats)
Motivation: abilities, financial resources, time resources of the potential attacker (for subjective threats)
Type of potential attacker: employee with malicious intent, employee unintentionally performing malicious activities, external attacker: former employee, hacker, layman, "script kiddy", hired professional, competitor, psychopath, etc.

Threat Examples

Violation of the security policy, execution of unauthorized activities, misuse of privileges by users or administrators
Damage to or failure of technical or software equipment
Identity misuse
Use of software contrary to license conditions

Malicious code (e.g. viruses, spyware, trojans)
Breach of physical security
Interruption of electronic communication services or electricity supply
Misuse or unauthorized modification of data

Attack

An attack is the realization of a threat.

Synonyms of attack

Security incident
IS failure (objective causes)
IS compromise (result of a subjective threat)

ISO/IEC 27005:2022 — definitions of threat, event, incident.

ISO/IEC 27032:2012 (Cybersecurity — Guidelines) — defines cyberattack explicitly as “an attempt to destroy, expose, alter, disable, steal or gain unauthorized access to or make unauthorized use of an asset.”

ISO/IEC 27005:2022 (Information security risk management) — threat sources, threat events, and their relationship to risks and incidents.

Types of Attacks (Threats)

Categories according to:

Strength and impact level (weak, medium, strong)
Target (data, hardware, software)
Source (internal, external)
Activity (active — data are modified, passive — data are not modified)
Intention (intentional — deliberate, unintentional — accidental)
Motivation
Type of impact (loss of confidentiality, availability, integrity, authenticity)

Types of Attacks by Strength

Catastrophic: leading to the collapse of the organization or to its criminal liability
Significant: causing serious damage to the organization
Insignificant: causing minor or negligible damage

Intentional attacks

The strength of the attack is related to the level of time, money, knowledge, etc. invested:
Weak attacker
amateur, accidental, script kiddie, etc.
Medium-strength attacker
hackers with knowledge and time, usually without significant financial resources
Strong attacker
professionals (industrial espionage, intelligence services, etc.)

Attacks Against Data Communication

ISO/IEC 27033 Network Security defines:

Interception attacks: eavesdropping, sniffing, wiretapping
Modification attacks: altering data in transit, man-in-the-middle (MITM)
Fabrication attacks: injecting false messages, spoofing, replay attacks
Interruption attacks: denial of service (DoS), jamming, cutting communication links

Relationship Schema for Risk Management in the IS

Figure 6. Relationship Schema for Risk Management in the IS

Acceptable Costs

Figure 7. Acceptable Cost of Security Controls

Procedure of Risk Analysis

Determination of the scope of the risk analysis (RA) Reference: ISO/IEC 27005:2022, 6 — Context establishment
Identification and valuation of assets Reference: ISO/IEC 27005:2022, 7.2 — Risk identification (assets)
Identification of vulnerabilities — critical areas Reference: ISO/IEC 27005:2022, 7.2 — Risk identification (vulnerabilities)
Risk estimation Reference: ISO/IEC 27005:2022, 7.3 — Risk analysis
Determination of unacceptable and acceptable risks Reference: ISO/IEC 27005:2022, 7.4 — Risk evaluation

Determination of expected annual losses Reference: ISO/IEC 27005:2022, Annex A — Risk assessment techniques (e.g. ALE)
Identification of applicable security measures (SM) to reduce risks to an acceptable level Reference: ISO/IEC 27005:2022, 8.2 — Risk treatment options
Estimation of annual savings after implementing security measures into the IS Reference: ISO/IEC 27005:2022, 8.6 — Risk treatment plan, cost-benefit analysis

Risk Estimation ISO/IEC 27005:2022 term

Asset: Description of the asset being assessed.
Impact value (1-5): Assessment of the impact that exploitation of this asset would have.
Threat value (1-5): Likelihood that a threat will affect this asset.

Vulnerability value (1-5): Likelihood that a vulnerability will be exploited.
Overall risk score: Calculation of the risk score as the product of the impact value, the threat value, and the vulnerability value. Risk = impact × threat × vulnerability
Control (Treatment measure): Proposed measures to reduce the risk.

Terminology EN-CZ-ISO

Term (CZ)	Term (EN)	ISO/IEC Reference
Aktivum	Asset	ISO/IEC 27002:2022, 3.1.2 - asset
Dopadová hodnota (1-5)	Impact value (1-5)	ISO/IEC 27005:2022, 3.1.14 - consequence
Hodnota hrozby (1-5)	Threat value (1-5)	ISO/IEC 27005:2022, 3.1.13 - likelihood of threat occurrence
Hodnota zranitelnosti (1-5)	Vulnerability value (1-5)	ISO/IEC 27005:2022, 3.1.13 - likelihood of vulnerability exploitation

Term (CZ)

Term (EN)

ISO/IEC Reference

Aktivum

Asset

ISO/IEC 27002:2022, 3.1.2 - asset

Dopadová hodnota (1-5)

Impact value (1-5)

ISO/IEC 27005:2022, 3.1.14 - consequence

Hodnota hrozby (1-5)

Threat value (1-5)

ISO/IEC 27005:2022, 3.1.13 - likelihood of threat occurrence

Hodnota zranitelnosti (1-5)

Vulnerability value (1-5)

ISO/IEC 27005:2022, 3.1.13 - likelihood of vulnerability exploitation

Terminology EN-CZ-ISO (2)

Term (CZ)	Term (EN)	ISO/IEC Reference
Celkové rizikové skóre	Overall risk score	ISO/IEC 27005:2022, 7.3.4 — determining the levels of risk (semi-quantitative scoring method)
Riziko = dopad × hrozba × zranitelnost	Risk = impact × threat × vulnerability	ISO/IEC 27005:2022, Annex A — examples of risk assessment techniques
Opatření	Control / Risk treatment measure	ISO/IEC 27005:2022, 8.2 — risk treatment options; ISO/IEC 27005:2022, 3.1.16 — control

Term (CZ)

Term (EN)

ISO/IEC Reference

Celkové rizikové skóre

Overall risk score

ISO/IEC 27005:2022, 7.3.4 — determining the levels of risk (semi-quantitative scoring method)

Riziko = dopad × hrozba × zranitelnost

Risk = impact × threat × vulnerability

ISO/IEC 27005:2022, Annex A — examples of risk assessment techniques

Opatření

Control / Risk treatment measure

ISO/IEC 27005:2022, 8.2 — risk treatment options; ISO/IEC 27005:2022, 3.1.16 — control

Case Study: a Complete Risk Analysis (WEB-SHOP) ISO/IEC 27005:2022

The fictional company WEB-SHOP sells goods online. It has its own office, from which the company is managed, and a warehouse for the goods sold, which is located at a different site than the office. The example below goes through the whole calculation: asset valuation, threat and vulnerability assessment, the risk value, the risk level, and the proposed controls.

Identified Assets and Their Valuation

The most important assets are marked 5.

Asset	Value (A)	Note
Information (customers, orders, goods)	5	the core business data
Server database	5	order and customer data
Hardware — servers	5	the technical foundation of the e-shop
Data in transit between the office and the warehouse	5	traffic over the public network
Warehouse database	4	stock and logistics data
Software — operating systems	4
Software — database systems	4
Services — server connection	4	availability of the e-shop
Office and warehouse network	3	connectivity between the two sites

Asset

Value (A)

Note

Information (customers, orders, goods)

the core business data

Server database

order and customer data

Hardware — servers

the technical foundation of the e-shop

Data in transit between the office and the warehouse

traffic over the public network

Warehouse database

stock and logistics data

Software — operating systems

Software — database systems

Services — server connection

availability of the e-shop

Office and warehouse network

connectivity between the two sites

Identified Threats and Associated Vulnerabilities

Threat	Vulnerability	Likelihood (T)	Vulnerability (V)
Malware / ransomware	missing or obsolete antimalware, unpatched system	4	4
Phishing / social engineering	insufficient security training of employees	3	5
Unauthorized modification of data	weak access control, no logging	3	4
Network intrusion / interception	unprotected public network connection	3	5
Hardware failure	no redundancy of the critical servers	2	3
Power outage	no UPS / backup power source	3	4
Theft of a server	warehouse on a separate site with weak physical security	1	3

Risk Analysis Table

The risk value is the product R = T × A × V, where T is the likelihood of the threat, A the value of the asset, and V its vulnerability (each on a 1—5 scale).

Asset — threat	A	T	V	R = A × T × V	Level
Information — unauthorized modification	5	3	4	60	MRV
Server database — malware / ransomware	5	4	4	80	HRV
Data in transit — interception	5	3	5	75	HRV
Hardware — servers — theft	5	1	3	15	LRV
Operating systems — network intrusion	4	3	4	48	MRV
Database systems — unauthorized modification	4	3	3	36	MRV
Services — server connection — denial of service	4	3	3	36	MRV
Warehouse database — power outage	4	3	4	48	MRV
Employees — phishing	4	3	5	60	MRV

For example, for the server database threatened by malware: R = A × T × V = 5 × 4 × 4 = 80, i.e. a high risk value (HRV). For theft of a server: R = 5 × 1 × 3 = 15, i.e. a low risk value (LRV).

Scales Used in the Example

Likelihood of the risk (T)

Low likelihood (LL) — a likelihood below 33 %,
Medium likelihood (ML) — a likelihood of 33—66 %,
High likelihood (HL) — a likelihood above 66 %.

Impact if the risk occurs

Minor adverse impact (MAI) — damages of up to 0.5 % of the total project value,
Medium adverse impact (MeAI) — damages of 0.51—19.5 % of the project value,
Major adverse impact (MjAI) — damages above 20 % of the project value, a threat to the project objective and deadline.

Risk value ® in this example

Low risk value (LRV) — R ≤ 20; the risk may occur at any time and will be mitigated or eliminated by the proposed control,
Medium risk value (MRV) — R = 21—60; the risk endangers the delay of a part of the project and is mitigated rather than eliminated, with an impact on resources and costs,
High risk value (HRV) — R > 60; the risk endangers the whole project; the controls can mitigate but not eliminate it.

Proposed Controls (Implementation of Mechanisms)

Risk (asset — threat)	Proposed control
Information — unauthorized modification	role-based access control (RBAC), audit logging, encryption
Server database — malware / ransomware	antivirus / EDR, patching, network segmentation, regular verified backups
Data in transit — interception	TLS/VPN for the connection between the sites, PKI
Hardware — servers — theft	mechanical barriers, electrical intrusion alarm, camera system
Operating systems — network intrusion	firewall, IDS/IPS, hardening, secure network topology
Database systems — unauthorized modification	RBAC, database audit
Services — server connection — denial of service	redundancy, load balancing, DDoS protection
Warehouse database — power outage	UPS, backup power source, regular verified backups
Employees — phishing	security awareness training, e-mail filtering, multi-factor authentication

Risk (asset — threat)

Proposed control

Information — unauthorized modification

role-based access control (RBAC), audit logging, encryption

Server database — malware / ransomware

antivirus / EDR, patching, network segmentation, regular verified backups

Data in transit — interception

TLS/VPN for the connection between the sites, PKI

Hardware — servers — theft

mechanical barriers, electrical intrusion alarm, camera system

Operating systems — network intrusion

firewall, IDS/IPS, hardening, secure network topology

Database systems — unauthorized modification

RBAC, database audit

Services — server connection — denial of service

redundancy, load balancing, DDoS protection

Warehouse database — power outage

UPS, backup power source, regular verified backups

Employees — phishing

security awareness training, e-mail filtering, multi-factor authentication

The Fraud Detection System (FDS) and DLP (Data Loss Prevention) complement the controls above for the detection of fraudulent transactions and the prevention of data leakage.