Northwind Freight: Choosing a Control Against a Stated Risk Appetite
Northwind Freight (180 staff, $60M revenue) runs a customer portal backed by a CRM whose data is valued at $2.4M. The risk register estimates a single successful breach would cost $600,000 in response, regulatory penalty, and churn, and that such a breach currently occurs roughly 0.4 times per year. The board's risk appetite statement caps any single risk at $75,000 annualized loss expectancy (ALE).
Two options are on the table. Option A is a managed web application firewall with virtual patching at $70,000/year, which pilot data suggests would cut the occurrence rate to 0.1. Option B is a $25,000/year secure code review programme with a projected rate of 0.25. The security budget has $80,000 unallocated this year, and the CFO has asked why the $30,000/year cyber insurance quote is not simply the answer instead.
1. Which option, if either, should be funded, and what must the board be told about the residual risk?
Read the worked answer
Do the arithmetic before the argument
- SLE = $600,000; current ALE = 0.4 x $600,000 = $240,000
- Appetite ceiling = $75,000 ALE
| Option | Cost/yr | New ARO | Residual ALE | Risk reduced | Net benefit |
|---|---|---|---|---|---|
| A - WAF | $70,000 | 0.1 | $60,000 | $180,000 | +$110,000 |
| B - code review | $25,000 | 0.25 | $150,000 | $90,000 | +$65,000 |
Fund A. Both options have positive net benefit, so return on spend does not decide this - the appetite statement does. B is the better ratio (3.6x versus 2.6x) but leaves $150,000 of residual ALE, double the ceiling the board has already accepted. A lands at $60,000, inside it, and fits the $80,000 envelope.
What the board must hear:
- ALE is a point estimate of a distribution, not a fact. The $600,000 single-loss figure is eight times the annual appetite, so the appetite statement is clearly about expected loss; the board should confirm that reading.
- A WAF does not remove the vulnerability, it virtual-patches it. If the subscription lapses, the exposure returns the same day - which is why B belongs in the next budget cycle, not the bin.
- Residual risk of $60,000 is formally accepted, and the acceptance needs a named owner and a review date, not just a minute.
2. The CFO asks why the $30,000 insurance policy cannot substitute for the firewall. Explain what insurance does and does not transfer, and how it interacts with the appetite statement.
Read the worked answer
Insurance is risk financing, not risk reduction - the treatment category is transfer, and it transfers only the financial slice.
What it transfers: indemnity up to the limit, after the retention/deductible, subject to sub-limits (often separate, low sub-limits for ransomware, social engineering, or dependent business interruption).
What it does not transfer:
- Legal and regulatory accountability - notification duties, breach reporting, and any findings of negligence stay with Northwind.
- Reputational and customer-churn damage, which is already baked into the $600,000 figure.
- Operational downtime and the cost of the response team, which is incurred regardless of recovery.
- Fines where uninsurable, and any claim prejudiced by the insured's failure to maintain reasonable security controls.
Judgement: the appetite statement is written against gross loss, so insurance cannot be counted as reducing ALE unless the board formally restates the metric as net of recoveries - and if it does, the retention, sub-limits, and claims-risk all need to be modelled, not assumed. The ordering matters: select controls first, then buy insurance sized to the residual retention the firm can absorb, because a $240,000 ALE risk left unremediated is exactly the fact pattern insurers use to decline or rescind a claim.
3. With the WAF approved, an engineer proposes giving all four platform engineers standing administrator rights to the WAF console 'because on-call is thin'. Assess this proposal against security principles.
Read the worked answer
The stated reason - thin on-call - is a staffing constraint, not an access requirement, and the proposal converts an operational inconvenience into a standing privilege risk.
Why it fails the principles:
- Least privilege: the requirement is 'someone must be able to change a rule during an incident within the response SLA', not 'four people need permanent write access'. Standing admin on the control that stands between the internet and the CRM is effectively a second production root.
- Separation of duties: the people who can edit rules are also the people who would investigate an incident caused by a bad rule change. No one can independently review their own action.
- Auditability: shared standing admin erodes non-repudiation; you cannot attribute a rule change to a person if the credential is one of four equivalent keys.
Counter-proposal:
- Just-in-time elevation with automatic expiry (e.g. 4-hour elevation), tied to the ticket, requiring a second approver outside business hours via an on-call approver rota.
- A genuine break-glass account for the 02:00 scenario, sealed credential, alert-on-use to the on-call security lead, and a mandatory post-use review within 24 hours.
- Compensating control for thin on-call: a documented emergency change procedure that permits a rule change to be made by the on-call engineer and reviewed retrospectively - the risk is bounded by the review, not by the headcount.
Accepting the proposal as written would create a finding at the next audit with no defensible rationale recorded.