Page 164 - CyberSecurityEssentialsEnglish

TABLE 4-4: A PRACTICAL CLASSIFICATION OF THE LEVEL OF IMPACT

Level Description Examples Review required

The error is easy to detect
Initial ideas, rewording, User review
Low and reverse and touches
training questions. before use.
no sensitive data.

The error may cause An internal summary, a Structured review
Medium rework, misunderstanding, preliminary analysis, a with a source or a

or limited cost. professional translation. test sample.

An expert or
It may affect rights, Hiring, education,
decision owner,
High opportunities, money, financing, health, legal,
evidence, and
health, or reputation. and safety decisions.
documentation.

Do not use, or
It breaches a policy, a law, Impersonating a person,
seek exceptional
Prohibited or a right, or creates exceeding permissions,
approval with
unacceptable harm. uploading restricted data.
special controls.

▣ A practical template: the use definition card

The required result: ....................
The actual user and the decision owner: ....................
The data used and its classification: ....................
The impact of error and its level: ....................
The criterion of success: ....................
The stopping condition and the escalation point: ....................

? Question to consider: how much error is acceptable?

Would the use still be acceptable if the output were wrong in one case out of ten?
Change the proportion according to the impact of the task, then decide whether the
current use is sufficient or whether it needs testing, an expert, or refusal.

● Remember: Section summary
• Key idea: Defining the use combines the purpose, the data, the impact, the decision

owner, and the stopping condition.
• Practical decision: Classify the impact before opening the tool, not after a problem
appears.
• Mistake to avoid: Treating the type of task alone as evidence of low or high risk,
without looking at the context.

163