Foundations capstone

Every failure in the Hartley Chambers scenario corresponds to a concept covered in the previous eight modules. Working through the mapping is the capstone exercise.

Module 1 (What cybersecurity is): The firm treated cybersecurity as an IT contractor responsibility rather than an organisational priority. No CISO or equivalent existed. The NIST CSF 2.0 Govern function was entirely absent.

Module 2 (Risk and outcomes): The document management system's single-factor authentication was a known risk that had not been formally assessed, scored, or assigned an owner. It appeared on no risk register. The firm had not completed a risk appetite exercise that would have flagged client confidentiality as a zero-tolerance area.

Module 3 (Data and integrity): Credentials stored in a shared spreadsheet on a document management platform represent a classification and handling failure. Credentials are assets that should be stored in a password manager with access controls, not in a shared file without any label or handling restriction.

Module 4 (Networks and transport): The document management system was not segregated from the finance system. A single compromised credential provided lateral movement across both. Defence in depth and network segmentation were absent.

Module 5 (CIA triad): The primary violation was confidentiality: 47 client matters were accessed by an unauthorised party. The potential secondary violation was integrity: had the attacker modified documents or financial data, the firm might not have detected it. Availability was not directly affected, which is why the breach went undetected for three months.

Module 6 (Identity and access): The document management system had no MFA despite handling highly sensitive client data. The paralegal's credentials gave access to far more than their role required, a least-privilege failure. No access review process existed.

Module 7 (Human factors and phishing): A phishing email successfully harvested credentials. The firm had no regular phishing simulation programme and no process for staff to easily report suspicious emails. No out-of-band verification process existed for the document management login.

Module 8 (Privacy and data protection): The firm failed to notify the ICO within the 72-hour window required by UK GDPR Article 33. Client matter data constitutes personal data subject to the UK GDPR. The four-day containment response extended the exposure period unnecessarily.

Applying the NIST CSF 2.0 functions to the Hartley Chambers scenario shows clearly which functions were absent.

Govern: a board-level risk owner for client data confidentiality would have driven MFA deployment, access reviews, and incident response planning as non-negotiable baseline controls.

Identify: a formal asset inventory would have flagged the document management system as a high-value target housing confidential client data, triggering a risk assessment and MFA requirement.

Protect: MFA on all systems handling client data, least-privilege access scoped to matter-level rather than platform-level, and credential storage in a managed password vault rather than a shared spreadsheet.

Detect: active log review with automated alerts for unusual access patterns would have detected the three-month intrusion within days rather than weeks. The security logs existed; they were simply not being monitored.

Respond: a pre-written incident response plan with a designated responder, a containment checklist, and a 72-hour ICO notification workflow would have compressed the response from four days to hours.

Recover: post-incident review of all 47 affected matters, client notifications, and a lessons-learned exercise feeding back into the Govern function to prevent recurrence.

Before progressing to the Applied Cybersecurity stage, you should be comfortable with the following. If any item feels uncertain, revisit the corresponding module.

Definitions and scope: You can explain what cybersecurity covers and does not cover, and why the NIST CSF 2.0 has six functions rather than five.

Risk: You can apply the likelihood-times-impact formula, distinguish threat from vulnerability from exploit, and explain risk appetite using a realistic example.

Data: You can classify data under HMG GSC, identify the three data states and their appropriate controls, and explain how SHA-256 provides integrity verification.

Networks: You can distinguish stateful from stateless firewalls, explain why TLS 1.3 is preferred over TLS 1.2, and describe what defence in depth means in practice.

CIA and STRIDE: You can give a real-world example of each CIA property being violated and map a given attack to a STRIDE category.

Identity: You can compare SMS OTP, TOTP, and FIDO2, explain the principle of least privilege, and describe what access creep is.

Human factors: You can classify phishing variants, identify which Cialdini principle is being exploited in a scenario, and evaluate a proposed awareness training programme.

Privacy: You can apply the six UK GDPR lawful bases, explain the 72-hour breach notification obligation, and describe data minimisation in system design terms.