Data Breach Risks

Security incidents occur when an organization experiences a breach of the confidentiality, integrity, and/or availability of information or information systems.

The DAD Triad

The DAD triad explains the three key threats to cybersecurity efforts: disclosure, alteration, and denial. Each of these three threats maps directly to one of the main goals of cybersecurity:

Disclosure is the exposure of sensitive information to unauthorized individuals, otherwise known as data loss. Disclosure is a violation of the principle of confidentiality.
Alteration is the unauthorized modification of information and is a violation of the principle of integrity.
Denial is the disruption of an authorized user's legitimate access to information. Denial events violate the principle of availability.

Breach Impact

We can categorize the potential impact of a security incident using the same categories that businesses generally use to describe any type of risk: financial, reputational, strategic, operational, and compliance.

Financial risk is the risk of monetary damage to the organization as the result of a data breach.
Reputational risk occurs when the negative publicity surrounding a security breach causes the loss of goodwill among customers, employees, suppliers, and other stakeholders.
Strategic risk is the risk that an organization will become less effective in meeting its major goals and objectives as a result of the breach.
Operational risk is risk to the organization's ability to carry out its day-to-day functions.
Compliance risk occurs when a security breach causes an organization to run afoul of legal or regulatory requirements.

Don't feel like you need to shoehorn every risk into one and only one of these categories. In most cases, a risk will cross multiple risk categories.

10 questions.