Interactive Activity: Identifying Security Controls in a Business Scenario

This activity is designed to develop your ability to identify security control gaps and recommend appropriate responses from a management perspective. Read the scenario carefully, then work through the tasks below. There are no single correct answers: the goal is to apply the concepts from this week’s learning to a realistic situation and to develop your security thinking in a practical context.

The Scenario

Amara is a mid-level manager at a regional logistics company with operations in five countries across West Africa, South-East Asia and Europe. Her team of eighteen staff coordinates customer orders, manages supplier relationships and handles billing and invoicing. The team works in a hybrid model: some staff are based in the main office, others work from home, and two senior account managers are frequently on the road visiting clients and suppliers.

The company has an information security policy, but Amara is not certain that all of her team members have read it or understand what it requires of them. During a busy week, she notices the following situations in her team:

• Personal email use: two team members regularly use their personal email accounts to send documents to clients and suppliers when the work email system is slow or unavailable. They have been doing this for several months and regard it as a practical solution to a recurring inconvenience.
• Shared login credentials: the entire team uses a single shared login for the main customer database. This arrangement was set up when the team was much smaller and has never been updated. No one person is accountable for actions taken through the shared account.
• Former employee access: Amara notices, during a routine system check, that two team members who left the organisation three months ago still appear in the system with active user accounts. She is not certain what access those accounts carry.
• Unauthorised payment: a supplier sent an urgent payment request by email. One team member, under significant time pressure and without consulting a colleague, processed the payment without following the organisation’s standard two-person verification procedure. The payment turned out to be legitimate on this occasion, but the verification procedure was designed precisely to guard against fraudulent payment requests of this kind.
• No incident reporting procedure: when Amara asks her team what they would do if they received a suspicious email or believed their account had been compromised, she finds that there is no clear agreed procedure. Different team members give different answers, and several say they would not report it at all for fear of being blamed.

Your Tasks

For each of the five observations above, work through the following questions and make notes on your responses:

• Control classification: which type of control (preventive, detective or corrective) is most relevant to addressing this issue? Is there more than one type of control that could usefully be applied?
• Security dimension: which dimension of the People, Processes and Technology model does this issue primarily relate to? Is there more than one dimension involved?
• CIA Triad connection: which of the three CIA principles (confidentiality, integrity or availability) is most at risk because of this issue? Explain your reasoning.
• Management action: what one practical step could Amara take as a manager to begin addressing this issue, without requiring significant technical expertise or budget? The action should be realistic and achievable within the constraints of a normal management role.
• Priority ranking: having worked through all five issues, rank them from most to least critical in terms of the risk they pose to the organisation. Be prepared to explain your reasoning.

Share your analysis in the course discussion forum. Pay particular attention to how other learners from different countries, sectors and organisational contexts prioritise the five issues. You are likely to find genuine differences of opinion, reflecting different threat environments, different regulatory contexts and different organisational cultures. That diversity is a valuable part of the learning experience.

A Note on Scenario-Based Learning

Scenarios like this one are used extensively in professional security training because they reflect the reality that security decisions are rarely clear-cut. Real organisations face constraints of time, budget and competing priorities. Real managers must weigh security considerations against operational pressures and team dynamics. Working through realistic scenarios in a learning environment builds the judgement and the habit of security thinking that makes a difference in practice.