Cybersecurity and Digital Resilience
The Global Centre for Risk and Innovation (GCRI)
Most intrusions involve stolen or misused credentials, and most harm involves data: stolen, encrypted, altered or exposed. Identity and access management, strong authentication, encryption and data minimisation are the core defences. This page sets out how identity and data are attacked, how they are protected, how breaches are measured, and what evidence serves the organizations and data protection authorities responsible.
GCRI · In development · service level R0
Identity and data security is the protection of who can access systems and of the information they hold. Most intrusions use stolen or misused credentials, privilege expands harm and copies of data spread, so phishing-resistant authentication, least privilege, encryption and data minimisation are core defences.
For identity and data security, in GCRI's spatial-intelligence reading, the map opens on true-colour imagery, night lights and population density with true colour from NASA GIBS, framed on Europe; every other NASA layer, live feed and forecast waits in the layer list.
The interactive map needs JavaScript; the layer list and sources are below.
Layers 3
Connected activity, for this page
Keyboard, with the map focused
Hold Ctrl or ⌘ and scroll to zoom
Latest available
NASA GIBS / EOSDIS · ASTER GDEM (METI, NASA) · Blue Marble (NASA) · © OpenStreetMap contributors (ODbL) · Natural Earth
Loading the latest NASA imagery.
Drag to move. Ctrl or ⌘ and scroll, pinch or the buttons to zoom; hover for the values under the pointer; reset returns to the region.
For identity and data security, in GCRI's spatial-intelligence reading, the map opens on true-colour imagery, night lights and population density with true colour from NASA GIBS, framed on Europe; every other NASA layer, live feed and forecast waits in the layer list.Satellite and model products as NASA publishes them, each with its own date; indicators, not assessments of any place; claim ceiling INTEGRATED.
Layers and dates
Authentication, authorization and privacy. The dossier below sets out how the risk develops, what is measured, where the data come from, how it is modelled and who decides.
Phishing, password reuse, stolen session tokens and credential stuffing let attackers log in rather than break in. Phishing-resistant authentication blocks many of these paths.
Accounts with broad or standing privileges let attackers move laterally and reach sensitive data. Least privilege and just-in-time access limit the damage.
Copies of data accumulate in backups, analytics, test systems and third parties. Data that is not needed and not kept cannot be stolen.
Exposed personal data leads to fraud, identity theft, extortion and loss of trust, and the harm continues long after the breach.
Each term as this page uses it. Where a standard-setting body defines the term, the wording follows that body.
| Term | Definition |
|---|---|
| Multi-factor authentication | Authentication requiring two or more independent factors, such as a password and a device. |
| Passkey | A phishing-resistant credential based on FIDO standards that replaces passwords with cryptographic keys. |
| Data minimisation | Collecting and keeping only the personal data needed for a stated purpose. |
Each indicator carries its unit, its cadence, the kind of source behind it and the evidence label a value would carry. No values are shown: a programme supplies them under its own authority.
| Indicator | Unit | Cadence | Source type | Label |
|---|---|---|---|---|
| Accounts using phishing-resistant authentication | percent of accounts | monthly | Identity system reports | OBSERVED |
| Privileged accounts | count | monthly | Access management records | OBSERVED |
| Personal data breaches notified to regulators | count | annual | Data protection authority statistics | OFFICIAL |
| Records exposed in breaches | count | per breach | Breach notifications | REPORTED |
| Sensitive data encrypted at rest | percent of data stores | per assessment | Security assessments | DECLARED |
| Credential exposure in breach datasets | count of organizational accounts | monthly | Breach monitoring services | OBSERVED |
The topic as a computational graph: named sources feed the methods, an evidence review gates the outputs, and the decisions stay with the authorities that hold them.
Fig. 02Nodes carry their type, two metric rows and a state; connectors show what feeds what; dashed frames name the owners; the timeline is the cadence. Design of the pipeline, not a record of a run.
Named public datasets and institutional records, each with its licence class. Sources by agreement are used only under their terms and never republished.
| Source | What it gives | Licence class |
|---|---|---|
| Data protection authority annual reports and breach statistics | Breach notifications and enforcement | Public records, licence per authority |
| NIST Digital Identity Guidelines (SP 800-63) | Requirements for identity proofing and authentication | Public domain, US government |
| FIDO Alliance specifications | Standards for phishing-resistant authentication | Public, FIDO terms |
| Have I Been Pwned | Aggregated data from public breaches for exposure checks | Free service, terms of use |
| Verizon Data Breach Investigations Report | Patterns of credential use in breaches | Public report, Verizon terms |
Cybersecurity and Digital Resilience prepares evidence. The decisions below are taken by the authorities named, under their own rules, and never by the platform.
| Who decides | The question | Evidence this page serves |
|---|---|---|
| Organizations and their security teams | Which authentication and access controls to adopt | Authentication reviews; privilege counts |
| Data protection authorities | Where to focus guidance and enforcement | Breach statistics and trends |
| Product and service designers | What data to collect and keep | Minimisation methods |
As organizations move to cloud services and remote work, the network perimeter matters less and identity matters more. An attacker with valid credentials can often move through systems unnoticed. At the same time, organizations hold growing volumes of personal and sensitive data, and breaches expose people to fraud, discrimination and loss of privacy long after the incident.
Identity and data risks arise from credentials, privileges and data flows.
Passwords alone are weak. Phishing-resistant multi-factor methods, such as hardware keys and passkeys, greatly reduce account takeover.
Least privilege and regular review limit what a compromised account can do. Excessive standing privileges are a common enabler of serious breaches.
Encryption, data minimization and retention limits reduce what can be lost, and privacy-by-design keeps controls proportionate.
Identity has become the main target because it is the main key. Attackers increasingly bypass technical defences by tricking users, abusing password reset processes, stealing session tokens or exploiting service accounts with broad privileges that nobody reviews. Defences therefore combine strong authentication with careful management of privileges, monitoring of unusual behaviour and processes that make it easy to revoke access quickly.
Sign-in and access logs show patterns of misuse. They need careful retention and privacy safeguards.
Public breach notifications and incident reviews show common failure modes, though reporting thresholds differ between jurisdictions.
Evaluation of encryption and authentication schemes, applying cybersecurity and cryptography. Implementation errors often matter more than algorithm strength.
Studies of how people use authentication show where security measures are bypassed because they are hard to use.
The current service level is R0: information and enquiries. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.