Security Fundamentals and the Threat Landscape
Core ideas
Security rests on the CIA triad: confidentiality, integrity, and availability. Every control you meet can be classified by which of these it protects, and by whether it is preventive, detective, or corrective. Learn to separate threats (who or what can cause harm), vulnerabilities (weaknesses that can be exploited), and risk (the combination of likelihood and impact). Risk treatment options are avoid, mitigate, transfer, and accept.
Threats to name
Know the difference between malware families: viruses need a host and user action, worms self-propagate, trojans disguise themselves, ransomware encrypts for extortion, and rootkits hide. Social engineering targets people, not machines; phishing, spear phishing, vishing, and pretexting are common variants. Understand defense in depth (layered controls) and the principle of least privilege.
Traps in questions
Questions often swap definitions. A "vulnerability" is not a "threat," and a control that detects is not the same as one that prevents. Watch for scenarios where the best answer is a compensating control because the primary control is impractical. Another trap is confusing quantitative risk terms: SLE (single loss expectancy) times ARO (annualized rate of occurrence) equals ALE (annualized loss expectancy).
Worked example
An asset is worth $50,000; a fire would destroy 40% of it, so SLE = $20,000. The fire is expected once every 10 years, so ARO = 0.1. ALE = $20,000 x 0.1 = $2,000. If a control costs $500 per year, it is cost-justified because it is below the ALE.
Rule of thumb
When unsure, ask: what is being protected (CIA), how does the control act (prevent/detect/correct), and what is the residual risk after it is applied?