Security, Privacy, and Data Protection
Foundations
Security questions test whether you can match a threat to a control and a control to a policy. Know the CIA triad (confidentiality, integrity, availability), authentication vs authorization, least privilege, and defense in depth.
Threats and controls
Understand malware types (virus, worm, trojan, ransomware, spyware), phishing and social engineering, brute force, and insider risk. Map controls: MFA, strong password/passphrase policy, patching, endpoint protection, firewalls, encryption at rest and in transit, backups (3-2-1 rule), and access reviews.
Privacy and data protection
Distinguish PII from sensitive data, understand data minimization, retention, consent, and breach notification obligations at a conceptual level. Know that regulations vary by jurisdiction; never assert a specific legal requirement you cannot verify.
Traps
- Confusing authentication (who you are) with authorization (what you may do).
- Treating backup as archiving - backups are for recovery, not long-term retention.
- Assuming HTTPS alone protects data at rest.
- Clicking links in suspected phishing; questions reward out-of-band verification.
Rule of thumb - 3-2-1 backups
Three copies, on two media types, with one offsite. A backup you have never restored is a hope, not a control.
Worked example
A user receives an email asking them to "confirm payroll details" via a link. Recognize phishing. Do not click; verify through a known phone number or internal portal, and report to security.