QUESTION 5

Airspace Telecoms, an international mobile network provider, has been victim to several cyber-attacks in recent months. On the last occasion over 40,000 customer accounts were hacked and significant amounts of personal information were extracted by unknown parties. This one incident has brought into question the effectiveness of the security of Airspaces information systems. Because of the scale of the recent hacking, there has been considerable media criticism of Airspace. Customers are demanding that the company takes immediate action to investigate in full what happened and implement measures to strengthen the security of its systems. Many customers have already cancelled their contracts with Airspace Telecoms and moved to competitors who have not experienced similar hacking. A further impact is that the companys share price has fallen by 25% since the cyber-attack occurred, which has raised alarm among shareholders. Concerned with the reputational and business harm which the cyber-attacks have caused, the board of Airspace has constituted a risk committee. It comprises senior and experienced operational managers as well as experts in the field of cyber-security. The committee has been specifically tasked by the board with identifying the main cyber risks which the company currently faces, classifying and prioritising them, and then recommending appropriate mitigation strategies.

*A cyber-attack is a malicious action by individuals, groups, organisations or even nation-states which targets computerised information systems with the aim of stealing, altering, or even destroying targeted information by hacking into a susceptible system.

Required:

1. Identify the most significant risks which Airspace Telecoms faces from the threat of further cyber-attacks, classifying them and assessing their potential impact. (5 marks)
2. Recommend appropriate strategies to mitigate/manage the cyber-attack risks facing Airspace Telecoms using the TARA framework. (8 marks)
3. Explain the importance of risk awareness at all levels in Airspace Telecoms and advise how risk awareness could be embedded into its corporate culture. (7 marks)