Module 73: Security Introduction
Risk
🏠The everyday picture
You lock your front door every night but don't hire a security guard. You've weighed how likely a break-in is and how bad it would be against the cost of each precaution.
📘What it really is
-
Risk combines likelihood (how probable) and impact (how bad). A simple scale: rate each from 1 (low) to 3 (high) and multiply: 1–2 low, 3–4 medium, 6–9 high.
-
A risk register lists each risk: description, likelihood, impact, score, owner, and the decision.
- Four ways to treat a risk:
- reduce: add a control (MFA, validation, backups);
- avoid: stop doing the risky thing (don't store card numbers at all; use a payment provider);
- transfer: pass part of it to others (a managed database, insurance, a payment gateway);
-
accept: consciously live with it, when it's low or the fix costs more than the harm; write it down and review it.
-
Deal with high risks first, especially high-impact ones that are cheap to fix.
- Avoiding sensitive data is often the strongest control: data you don't collect can't leak (Module 79).
- Review risks after changes (new features, new integrations) and after incidents.
🖱️Try it
Create risk-register.md for your CRM with at least eight risks (for example: stolen admin password, SQL injection, leaked
database backup, server disk failure, malicious dependency, staff member exports all customers, accidental deletion, DDoS).
Score each, choose a treatment, and assign an owner (you). These become the review list for Project D.
✅Quick check
What two things make up risk?
Show the answer
Likelihood and impact.
Give an example of avoiding a risk rather than reducing it.
Show the answer
Not storing card details at all by using a payment provider (or any example of not collecting or doing the risky thing).