Risk, frameworks and the law

Security teams never have enough time or money for everything, so they rank risks. A simple way: score likelihood and impact each from 1 to 5 and multiply. Work on the highest scores first.

risks = {"Laptop stolen": (3, 4), "Phishing works": (4, 4), "Office flood": (1, 5)}
for name, (likelihood, impact) in sorted(risks.items(), key=lambda r: -r[1][0] * r[1][1]):
    print(name, likelihood * impact)

Each risk is then treated one of four ways. Reduce it with controls (MFA, training, encryption). Transfer it, partly, to someone else (cyber insurance, a contract with a supplier). Avoid it by stopping the risky activity (don't collect data you don't need). Or accept it, on purpose and written down, when fixing it costs more than the harm. A control is anything that reduces risk: technical (a firewall), administrative (a policy, training) or physical (a locked server room).

Frameworks give a shared checklist. The NIST Cybersecurity Framework (CSF 2.0) groups the work into six functions: Govern (set the strategy, roles and policies), Identify (know your assets and risks), Protect (controls like MFA and patching), Detect (logging and alerts), Respond (incident response) and Recover (restore and improve). ISO/IEC 27001 is an international standard companies can be certified against, and CIS Controls is a prioritised list of practical steps.

Security knowledge comes with a line you must not cross. Accessing a computer or account without permission is a crime in most countries (the Computer Fraud and Abuse Act in the US, the Computer Misuse Act in the UK), even to "just look" or "prove a point". Penetration testers attack systems only with written permission that says exactly what's in scope. To practise, use your own machines, deliberately vulnerable practice labs, or capture-the-flag (CTF) events, which are built for it. If you find a flaw by accident, report it through the company's vulnerability disclosure page.

If you'd like a job in it, there are many routes: SOC analyst (watching alerts), incident responder, security engineer (building the defences), penetration tester, governance, risk and compliance (GRC), and cloud or application security. Most start from IT, networking, Linux or programming, which the other courses here cover.