What Mangrove has to protect

An asset is anything of value that could be harmed. At Mangrove Market that means about 2 million customer accounts, the payment flows (cards, cash on delivery, mobile wallets), about 400 checkout tills (the POS), the Partner app where 1,800 corner shops pay invoices, and the accounts of about 1,920 store staff, which are keys to many of the others.

Security teams describe harm to an asset with three words, often called the CIA triad:

• Confidentiality: only the right people can read it. A copied customer list breaks it.
• Integrity: it is correct, and changes only through the right people and steps. A price quietly edited on the tills breaks it.
• Availability: it works when people need it. Tills that freeze on a festival evening break it.

Ask all three questions about every asset, because the obvious one is not always the costly one. Ransomware sounds like a data problem, but at a grocery chain it is mostly an availability problem: the stock and price data is still there, encrypted, and the stores cannot use it. Many groups also copy the data first, which adds a confidentiality problem. And describe harm in the business's language: "every store could stop taking card payments for a day" gets a budget; "server 14 is exposed" does not.

Threats, vulnerabilities and risk

• A threat is something that could cause harm. Often it is a person or group, a threat actor. It can also be an event, such as a flood or a power cut.
• A vulnerability is a weakness a threat could use: a reused password, a server nobody patches, a process with no second check.
• A risk is the chance that a threat uses a vulnerability to harm an asset, combined with how bad the harm would be.

Risk needs all the pieces at once: a weakness no threat can reach is a small risk, and so is an attacker with no weakness to use. That is why a good risk statement names every link in one sentence: "Because staff can change bank details on Partner invoices without a second approval (vulnerability), a fraudster who takes over a sales rep's account (threat) could redirect partner payments (impact on the invoices)." If you cannot fill in every part, you do not understand the risk yet.

Who are the threat actors for a grocery chain? Mostly people who want money.

Notice what is missing: spies and movie villains. A grocery chain is far more likely to meet a criminal group phishing its 1,920 store staff than a government agency, so spend your effort on the actors who would actually come. Most attacks on a company Mangrove's size are run like a business: the attacker picks the cheapest route to a payout. Insiders are uncomfortable to list, but leaving them out leaves a blind spot, and most insider incidents are honest mistakes. The difference from a fraudster is access: the insider already has a legitimate account; the fraudster abuses a process anyone can use.

Scoring risk: likelihood × impact

You will always find more risks than you can fix this quarter, so you need a way to order them. The simplest method rates each risk on two 1-to-5 scales and multiplies them. Likelihood is how likely it is to happen in the next year. Impact is how bad it would be if it did. The score runs from 1 to 25.

The scales only work if everyone means the same thing by each number, so write anchors down before anyone scores. These are example anchors for Mangrove; set your own with leadership.

Then group scores into bands so people can talk about them quickly: 15 to 25 critical, 10 to 14 high, 5 to 9 medium, 1 to 4 low. The exact cut-offs matter less than writing them down and using them every time.

The scores live in a risk register: one row per risk with its statement, the asset, likelihood, impact, score, an owner (a named person, not a team), the treatment and a review date. There are four treatments. Reduce it with controls. Accept it, in writing, by someone with the authority to accept that loss. Transfer it, with insurance or a contract. Avoid it by stopping the risky activity: Mangrove avoids most card-data risk by letting its payment provider store card numbers instead of keeping them. What is left after the controls is the residual risk, and someone has to accept that too.

Two warnings. First, 5 × 2 and 2 × 5 both make 10, but a frequent small loss needs a process fix while a rare disaster needs a recovery plan, so always read the two numbers. Second, the numbers are labels, not measurements: a 12 is not "twice as bad" as a 6. Use the score to sort the conversation, then use judgement. You will come back to registers and frameworks such as NIST CSF in Risk, compliance and the first hour of an incident.

Mangrove's attack surface and the three questions

The attack surface is every place where an attacker could try to get in or get data out. At Mangrove it is much wider than the website:

• The Mangrove app and its APIs: about 2 million customer accounts.
• The Partner app: 1,800 shops ordering stock and paying invoices. It is built and run by an outside agency, Lagoon Digital, so their people and laptops are part of Mangrove's surface too.
• The POS: about 400 tills that handle card payments.
• Store Wi-Fi: a guest network for customers next to the network the tills and about 1,000 handheld scanners use.
• Staff accounts: about 1,920 store staff plus head office, each of whom can be phished or reuse a password.
• The back office and the build pipeline: dashboards, email, GitHub and the pipeline that ships code.

With the surface in front of you, ask the three questions the burglar asked:

• What would I want? Money (payments, refunds, invoices, a ransom), data to sell, or leverage (stopping the stores until someone pays). The answer tells you which assets to look at first.
• What is the cheapest way in? Attackers prefer logging in to breaking in. A password reused from another site's breach, a staff member who clicks a convincing email, an old test server nobody patches. Clever new techniques are rare; cheap old ones are everywhere.
• How would anyone notice? Which log records it, which alert fires, who reads the alert, and how fast. If the honest answer is "when a customer complains", you have found a gap.

Each answer becomes a defender's job: protect the thing worth taking, close or watch the cheap doors, and make noise where things are quiet. The next lesson, How breaches really happen, follows how real attacks chain these steps together, and Identity: passwords, MFA and passkeys deals with the cheapest door of all.

Controls and defence in depth

A control is anything that reduces a risk. It can be technical (multi-factor sign-in), a process (a second approval) or physical (a locked network cabinet). The most useful way to sort controls is by when they act:

• Preventive controls stop it happening: MFA on staff accounts, a second approval for bank-detail changes, a till network kept apart from guest Wi-Fi.
• Detective controls notice when it happens anyway: an alert on hundreds of failed sign-ins, a nightly comparison of till totals with bank deposits, a log of who changed which bank details.
• Corrective controls limit the damage and restore normal service: restoring from tested backups, forcing password resets, recalling a payment, patching the weakness that was used.

No control is perfect, so you layer them. Defence in depth means an attacker has to beat several independent controls. Follow a stolen staff password at Mangrove. MFA blocks most attempts to use it (preventive). If one gets through, the account can reach only what that job needs, a rule called least privilege (preventive again, limiting the reach). A sign-in from a new country at 3 am raises an alert (detective). The team locks the account and reverses any changes (corrective).

The commonest gap in a young risk register is a column full of preventive controls and no detective ones. Prevention fails eventually, and without detection you learn about it from a customer or the news. Every high or critical risk needs at least one control that would tell you it is happening.