Vodafone 2015 Annual Report Download - page 35

Operational risk
1. Malicious attack on the network/IT infrastructure
Risk description Assessment Mitigation
A successful cyber-attack
on our network could result
in us not being able to deliver
service to our customers,
resulting in serious damage
to our reputation, consequential
customer and revenue loss and
the risk of nancial penalties.
This risk is possible in all markets
in which we operate and has
the potential for signicant
impact. Certain systems operate
at a Group level and as such,
a single attack on one of these
systems has the potential
to impact multiple markets
simultaneously, further
magnifying the impact.
This risk has been separated from
non-malicious network failure
to recognise the greater cross-
market impact a malicious attack
could have on the business.
a We have a well-established global security community; with our Group security function
working closely with our local market security teams
a We work closely with a variety of security communities of interest which include relevant
government bodies, commercial groups, suppliers and enterprise customers
a We are continually assessing our security policies, standards and procedures and adjusting
them so they are commensurate to the threat prole we face. These assessments are used
to create a focused security investment programme that ensures that the required security
controls are in place and are effective
a Each year we run security programmes to identify and deliver additional activities with the
aim of further strengthening our control environment. Our aim is to ensure that our critical
infrastructure is enhanced to reduce the likelihood of unauthorised access and to reduce the
impact of any successful attack
a We manage the risk of malicious attacks on our infrastructure using our global security
operations centre that provides 24/7 proactive monitoring of our global infrastructure
a We have multiple layers of assurance in place. Our activities include regular
technical assurance and audit activities including vulnerability scanning and ethical
hacking programmes
Operational risk
2. Customer data misuse or leakage
Risk description Assessment Mitigation
Our networks carry and store
large volumes of condential
personal and business voice
trafc and data. Failure to protect
or correctly use this data
could result in unintentional
loss of, or unauthorised
access to, customer data.
This could adversely affect our
reputation and potentially lead
to legal action.
This risk is possible in all markets
in which we operate. The impacts
of this risk have the potential
to be major in mature markets
with robust data protection
regulations covering personal
information, voice trafc and data.
Furthermore, we generally hold
a greater volume of condential
personal information in our
mature markets, due to the
higher proportion of customers
paying their bills by automated
bank transfer or credit card.
a We have a data privacy programme aimed at ensuring we use data in our possession
appropriately. The programme is based on existing regulations and internationally
recognised standards
a We closely monitor the data privacy regulatory environment in relevant markets and
implement changes to our processes and procedures as appropriate
a Both the hardware and software applications which hold or transmit condential personal and
business voice and data trafc include appropriate security features
a Security related reviews are conducted according to our policies and security standards,
focused on the highest risk applications and processes
a Our data centres are managed to international information security standards
a Security governance and compliance is managed and monitored through software tools that
are deployed to all local markets
a We have an ongoing awareness communications campaign in place that includes providing
security and privacy awareness training to all Vodafone employees, prior to granting access
to customer data
a We have an assurance programme in place that incorporates both internal reviews and reviews
of third parties that hold data on our behalf
a We are implementing data access management tools to monitor any unauthorised access and
leakage of our condential data
Relative movement within Group principal risks:
Increased
Relative movement within Group principal risks:
Increased
Overview Strategy review Performance Governance Financials Additional information Vodafone Group Plc
Annual Report 2015
33