Tutorial activities

Week 8 Activity

Tue, 31 Mar 2026 15:51:40 GMT

by Hrachya Yeghikyan.

Hrachya Yeghikyan - (2526551)

Cybersecurity Report: E-Commerce TechTraders Ltd.

Introduction – Framing the Critical Questions

In analysing the cybersecurity posture of TechTraders Ltd., it is essential to begin with the right questions rather than assumptions. What mechanisms are in place to prevent unauthorised access to customer data? Are the deployed firewalls actively inspecting and filtering malicious traffic, or are they operating at a superficial level? Furthermore, does the organisation’s VPN infrastructure genuinely secure remote access, or does it introduce additional vulnerabilities?

As an e-commerce entity, TechTraders Ltd. operates within a highly exposed digital environment. Its infrastructure includes customer-facing web applications, payment processing systems, and internal administrative networks. This creates multiple entry points for potential attackers. Consequently, the implementation of robust security technologies is not optional but fundamental.

Firewalls serve as the primary boundary defence. In modern environments, next-generation firewalls (NGFWs) are expected to perform deep packet inspection, intrusion detection, and application-level filtering. Their effectiveness, however, is directly dependent on accurate configuration and continuous monitoring. Similarly, Virtual Private Networks (VPNs) are designed to secure communication channels, particularly for remote access. When properly implemented—with strong encryption protocols and multi-factor authentication—they provide a secure tunnel into the network. However, misconfigured VPNs can become critical points of failure, effectively granting attackers direct internal access.

Main Analysis – Consequences of Ineffective Security Implementation

The consequences of inadequate firewall and VPN implementation within TechTraders Ltd. are significant and far-reaching. A poorly configured firewall may fail to detect and block common attack vectors such as SQL injection or cross-site scripting (XSS). This can allow attackers to gain initial access to the system, after which they can escalate privileges and move laterally across the network.

The risks are further amplified when VPN vulnerabilities are introduced. If an attacker compromises VPN credentials or exploits weak encryption standards, they effectively bypass external security controls. At this stage, the attacker is no longer constrained by perimeter defences and can directly interact with internal systems, including databases and administrative interfaces.

Such breaches lead to multiple layers of impact. Financial losses may arise from fraud, ransom demands, or operational downtime. Legal consequences are also highly relevant, particularly under frameworks such as the General Data Protection Regulation (GDPR), where data breaches can result in substantial penalties. In addition, reputational damage can severely undermine customer trust, which is critical for any e-commerce platform. Operationally, the organisation may experience service disruptions that affect both revenue generation and long-term sustainability.

These outcomes demonstrate that cybersecurity weaknesses are not isolated technical issues; they translate directly into business risk.

Conclusion – Analytical Perspective

From an analytical standpoint, the effectiveness of security technologies such as firewalls and VPNs is determined not by their presence, but by their configuration, integration, and continuous management. TechTraders Ltd. must adopt a layered security approach in which perimeter defences, secure remote access, and internal monitoring mechanisms operate cohesively.

In my assessment, organisations that approach cybersecurity as a static requirement are inherently vulnerable. Security must instead be treated as a dynamic process, requiring constant evaluation and adaptation in response to evolving threats. For TechTraders Ltd., this means prioritising not only the deployment of advanced technologies but also the expertise required to manage them effectively.

Ultimately, a well-configured firewall and a securely implemented VPN do not merely reduce risk; they form a critical foundation for maintaining trust, ensuring compliance, and sustaining long-term operational resilience.

Re: Week 7 activity 2

Tue, 24 Mar 2026 17:32:00 GMT

by Md Monsuruzzaman.

group 2

Re: Week 7 activity

Tue, 24 Mar 2026 17:31:34 GMT

by Harsh Bipinbhai Valand.

harsh valand:2437861

dhrumil acharya:2629430

hari patel:2520160
sadab kureshi:2530072
tassavar kureshi:2530068

vinay patel:2519364

A. Identification of Key Risks

The following risks have been identified based on the AI deployment plan and governance framework. Risks span six core categories:

Category	Description	Example Risks Identified
Ethical / Compliance	Risks related to fairness, bias, and regulatory obligations	Bias in outputs, GDPR breach, EU AI Act non-compliance
Technical / Security	Risks from system failures, cyberattacks, and model issues	System downtime, adversarial attacks, model drift
Operational	Risks affecting day-to-day operations and processes	Staff skills gap, explainability gaps, vendor lock-in
Strategic	Risks to organisational goals and stakeholder relationships	Resistance to adoption, poor stakeholder trust
Financial	Risks to budget and financial sustainability	Cost overrun, compute budget escalation
Legal	Legal liability and intellectual property risks	IP/copyright infringement in training data or outputs

B. Risk Assessment — Risk Register

Each risk has been assessed using Likelihood × Impact scoring. Scores determine priority classification (High, Medium, or Low).

ID	Risk Description	Category	Likelihood	Impact	Score	Priority	Strategy
R01	Bias and Discrimination in AI Outputs	Ethical/Compliance	Frequent (3)	High (3)	9	HIGH	Treat
R02	Data Privacy Breach / GDPR Non-Compliance	Compliance/Legal	Occasional (2)	High (3)	6	HIGH	Treat + Transfer
R03	AI System Failure or Downtime	Operational/Technical	Occasional (2)	High (3)	6	HIGH	Treat
R04	Lack of Stakeholder Trust / Resistance to Adoption	Strategic	Frequent (3)	Medium (2)	6	HIGH	Treat
R05	Adversarial Attacks / Model Manipulation	Technical/Security	Occasional (2)	High (3)	6	HIGH	Treat
R06	Regulatory Non-Compliance (EU AI Act)	Compliance/Legal	Occasional (2)	High (3)	6	HIGH	Treat
R07	Model Drift and Performance Degradation	Technical/Operational	Frequent (3)	Medium (2)	6	HIGH	Treat
R08	Intellectual Property / Copyright Infringement	Legal	Occasional (2)	Medium (2)	4	MEDIUM	Treat + Transfer
R09	Cost Overrun / Budget Escalation	Financial	Occasional (2)	Medium (2)	4	MEDIUM	Treat
R10	Insufficient Explainability (Black Box Problem)	Ethical/Operational	Frequent (3)	Low (1)	3	MEDIUM	Treat
R11	Vendor Lock-In / Third-Party Dependency	Strategic/Operational	Occasional (2)	Low (1)	2	LOW	Tolerate + Treat
R12	Inadequate Staff Skills / Capability Gap	Operational	Occasional (2)	Low (1)	2	LOW	Treat

Risk Priority Matrix

The matrix below shows how Likelihood × Impact produces each priority rating used above:

	Low Impact (1)	Medium Impact (2)	High Impact (3)
Frequent (3)	MEDIUM (3)	HIGH (6)	HIGH (9)
Occasional (2)	LOW (2)	MEDIUM (4)	HIGH (6)
Rare (1)	LOW (1)	LOW (2)	MEDIUM (3)

C & D. Risk Mitigation Strategies and Justifications

The table below outlines the mitigation strategy for each identified risk and provides a full justification for the chosen approach. Strategies are based on the 4T framework: Treat, Transfer, Tolerate, and Terminate.

TREAT — Reduce risk via controls

TRANSFER — Shift to third party

TOLERATE — Accept and monitor

TERMINATE — Remove the activity

Row colours: RED = High | AMBER = Medium | GREEN = Low

ID	Risk	Strategy	Mitigation Actions	Justification
R01	Bias and Discrimination in AI Outputs	Treat	Implement mandatory bias audits pre-deployment using diverse test datasets. Establish a fairness review board. Use bias detection tools (e.g., IBM AI Fairness 360). Enforce fairness KPIs in model evaluation.	Bias is highly likely in AI systems trained on historical data. The impact is severe — it causes discriminatory outcomes, legal liability under the Equality Act 2010, and reputational damage. Treatment is preferred over tolerance because the harm to individuals is unacceptable. Residual risk: Low-Medium after continuous auditing.
R02	Data Privacy Breach / GDPR Non-Compliance	Treat + Transfer	Implement end-to-end encryption, strict data access controls, and data minimisation principles. Conduct DPIA (Data Protection Impact Assessment). Transfer residual risk via cyber insurance.	A GDPR breach carries fines of up to €20M or 4% of global turnover. While occurrence is moderate, the financial and reputational impact is severe. Dual strategy: Treat reduces likelihood through technical controls; Transfer via cyber insurance covers residual financial exposure. Residual risk: Low-Medium.
R03	AI System Failure or Downtime	Treat	Develop a robust disaster recovery and business continuity plan (BCP). Implement redundant infrastructure, failover systems, and regular load testing. Define SLAs with the infrastructure provider.	AI system downtime disrupts business operations and erodes user trust. Treatment through redundancy and BCP directly reduces impact by ensuring rapid recovery. A separate manual fallback process should exist for critical decisions. Residual risk: Low after redundancy is in place.
R04	Lack of Stakeholder Trust / Resistance to Adoption	Treat	Run a comprehensive change management programme including staff training, transparent communication about AI capabilities and limitations, and involving stakeholders in the design phase. Publish a clear explainability policy.	Resistance to AI adoption is a common and frequently observed risk. Without user buy-in, the system will not achieve its intended outcomes, rendering the investment worthless. Treating this risk through engagement and education is more effective than any technical solution. Residual risk: Low-Medium.
R05	Adversarial Attacks / Model Manipulation	Treat	Deploy adversarial robustness testing. Use input validation, anomaly detection, and rate limiting. Apply model hardening techniques such as adversarial training. Establish a security operations monitoring process.	Adversarial manipulation can cause the AI system to produce harmful or incorrect outputs deliberately. The technical and reputational consequences are severe. Treatment via security hardening is the only viable approach; this risk cannot be transferred to insurance alone. Residual risk: Medium.
R06	Regulatory Non-Compliance (EU AI Act)	Treat	Classify the AI system under the EU AI Act risk tiers. Appoint a dedicated compliance officer. Implement a compliance tracking system and schedule quarterly regulatory reviews. Engage legal counsel specialising in AI regulation.	The EU AI Act imposes significant obligations on high-risk AI systems. Non-compliance can result in operational bans and fines. Treatment is the only viable strategy — the regulation cannot be transferred or avoided. Proactive compliance also reduces audit risk. Residual risk: Low with active compliance management.
R07	Model Drift and Performance Degradation	Treat	Implement continuous model monitoring with automated performance dashboards. Set up drift detection alerts and a regular model retraining pipeline. Define performance thresholds that trigger human review.	AI models frequently degrade over time as real-world data distributions change — this is an inherent and predictable technical risk. Treating it through continuous monitoring and automated retraining pipelines is both cost-effective and reliable. Tolerating it would result in progressively worse outcomes. Residual risk: Low.
R08	Intellectual Property / Copyright Infringement	Treat + Transfer	Conduct thorough provenance checks on all training data. Obtain appropriate licences for third-party datasets. Implement output filtering for potential IP violations. Maintain IP indemnification insurance.	AI training data and generated outputs may inadvertently include copyrighted material. While not the most frequent risk, legal exposure is significant. A combined Treat + Transfer approach is justified: technical controls reduce likelihood while IP insurance mitigates financial exposure from any residual claims. Residual risk: Low.
R09	Cost Overrun / Budget Escalation	Treat	Establish a detailed project budget with contingency reserves (minimum 15%). Implement monthly budget reviews and earned value management (EVM). Define cost escalation triggers and approval thresholds.	AI deployment projects are notorious for scope creep and underestimated compute costs. Regular financial monitoring and contingency planning directly reduce the likelihood of overrun. A 15% contingency is standard practice for technology projects of this nature. Residual risk: Low-Medium.
R10	Insufficient Explainability (Black Box Problem)	Treat	Adopt explainable AI (XAI) techniques such as SHAP values, LIME, and attention visualisation. Ensure decision outputs include confidence scores and plain-language explanations for end users and auditors.	Lack of explainability undermines user trust and complicates regulatory audits. While the direct operational impact is low, the cumulative effect on adoption and compliance creates medium-level risk. Treatment through XAI tools is well-established and cost-effective. Residual risk: Low.
R11	Vendor Lock-In / Third-Party Dependency	Tolerate + Treat	Design the system with open standards and modular architecture where feasible. Document all third-party dependencies. Monitor vendor stability. Include exit clauses in vendor contracts.	Vendor lock-in is a manageable risk that does not require immediate high-cost intervention. Toleration is appropriate given low current impact, combined with lightweight mitigation through contractual protections and open architecture principles as a long-term treat measure. Residual risk: Low-Medium.
R12	Inadequate Staff Skills / Capability Gap	Treat	Conduct a skills gap analysis prior to deployment. Design a targeted training programme covering AI literacy, system operation, and ethical use. Partner with universities or training providers for upskilling.	A capability gap, while low impact in isolation, can amplify other risks (e.g., misuse, poor governance). Treating this risk through structured training is low-cost relative to the operational benefits of a skilled workforce. Residual risk: Low.

Summary & Recommendations

The AI system deployment presents a complex risk landscape requiring proactive and layered mitigation. Key findings:

• 6 HIGH priority risks have been identified — all require immediate action before and during deployment.

• Ethical and compliance risks (R01, R02, R06) are the most consequential and demand dedicated governance oversight.

• Technical risks (R03, R05, R07) require robust engineering controls including monitoring pipelines and adversarial testing.

• Strategic risks (R04) must be addressed through people-centred change management — technology alone cannot resolve them.

• 4 MEDIUM priority risks require scheduled monitoring and mitigation plans within the first 3 months post-deployment.

• 2 LOW priority risks can be managed through standard operational governance processes.

Recommended Next Steps:

Priority	Action	Owner	Timeline
IMMEDIATE	Establish AI Ethics & Governance Board	Senior Leadership / CTO	Before deployment
IMMEDIATE	Conduct DPIA and bias audit on training data	Data Protection Officer	Before deployment
IMMEDIATE	Deploy disaster recovery and adversarial testing infrastructure	Engineering Lead	Week 1–4
SHORT TERM	Launch staff AI literacy training programme	HR / Change Manager	Month 1–3
ONGOING	Monitor model performance, drift, and compliance	AI Operations Team	Continuous

Document prepared as part of the Risk Management Work Phase | AI System Deployment Scenario | March 2026