Ticket sales under pressure: naming the risk correctly
Kaartlijn is a Dutch online ticket platform with 120 staff and €48 million annual sales. On Saturday at 10:00, when 38,000 customers were queued for a concert sale, a botnet sent 2.1 million requests per minute for 14 minutes. The site became unavailable; the sale was delayed and about €120,000 of orders were lost. No customer data was changed or disclosed. The load balancer was running firmware with a known remote-code-execution flaw that had been published six weeks earlier; the patch had been deferred because the change freeze covered the sale weekend. The CISO calls the event 'a breach'. The board asks whether to buy DDoS scrubbing for €60,000 per year or cyber insurance for €40,000 per year with a €25,000 deductible. The insurer requires an annual security assessment. A customer forum is full of complaints and one journalist has asked whether card data was stolen.
1. Classify the event using threat, vulnerability, risk and incident. Was it a 'breach' in the sense of a personal data breach? Explain your reasoning.
Read the worked answer
Threat, vulnerability, risk, incident
- Threat: the botnet and its operator, who deliberately sent volumetric traffic.
- Vulnerability: the unpatched load-balancer firmware, the change freeze that blocked the fix, insufficient capacity headroom, and unclear ownership of patch exceptions.
- Risk: the combination of likelihood and impact - peak-sale outage, lost revenue, reputational damage and regulatory scrutiny.
- Incident: the actual 14-minute unavailability on Saturday.
Breach? A personal data breach under GDPR involves accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. Here no data was changed or disclosed, and the outage did not destroy data. So it is not automatically a reportable personal data breach. It is still a security incident and may trigger contractual or NIS2 obligations. The CISO should not label it a breach before checking logs for exfiltration. Words matter: calling it a breach without facts drives the wrong notifications, legal costs and loss of trust. The correct response is to investigate confidentiality and integrity, then decide.
2. Which element of the CIA triad was affected, and how should that shape the choice between DDoS scrubbing and cyber insurance?
Read the worked answer
Only availability was directly affected. Confidentiality and integrity appear intact unless forensics show otherwise. That matters because the two options do different jobs.
- DDoS scrubbing reduces the likelihood and impact of the availability threat. It filters attack traffic before it reaches the platform, but it does not fix the remote-code-execution flaw, which is a separate threat with much higher confidentiality and integrity impact.
- Cyber insurance transfers the financial consequence of a residual event. It does not keep the ticket sale online, protect customers or restore reputation during the sale.
If the board can fund only one, scrubbing better matches the dominant risk at peak sales. But neither is a complete answer. The unpatched load balancer must be fixed or mitigated, capacity must be tested, and an incident runbook must define who decides to fail over. Insurance may still be justified for catastrophic residual risk and contractual requirements. The board should state its risk appetite and maximum tolerable downtime, then combine controls rather than treat a purchase as the strategy.
3. The board wants one measure. Give a reasoned recommendation, the residual risk, and two metrics that should be reported after the decision.
Read the worked answer
Recommendation: approve a time-bound package, not one purchase. First, patch or mitigate the load-balancer flaw under a documented emergency change, with a compensating WAF rule until the patch is validated. Second, buy scrubbing for the peak-sale window and require a capacity test before the next sale. Third, consider insurance only after the technical fixes, because insurance prices risk and will ask about the unpatched device.
Residual risk: botnets can still cause some degradation, scrubbing can be bypassed by application-layer attacks, and the remote-code-execution flaw may already have been exploited. The board, not the CISO alone, should accept the remaining risk with a review date.
Metrics to report:
- Peak-sale availability and time to restore service after an attack.
- Percentage of critical patches applied within the agreed SLA, including approved exceptions.
A third useful metric is cost per incident, split into lost revenue and recovery cost. These metrics show whether the decision reduced risk, rather than merely whether a contract was signed.