Information Security and Risk Management
What to Know
Master the CIA triad and how controls map to it. Know the control categories (technical, administrative, physical) and functions (preventive, detective, corrective, compensating). Understand risk terminology: asset, threat, vulnerability, likelihood, impact, inherent versus residual risk, risk appetite and tolerance, and the treatment options - mitigate, transfer, avoid, accept. Know qualitative versus quantitative assessment, and simple formulas such as single loss expectancy (asset value × exposure factor) and annualized loss expectancy (SLE × annualized rate of occurrence). Understand defense in depth, least privilege, separation of duties, authentication factors, encryption at rest and in transit, and incident response phases (prepare, detect, contain, eradicate, recover, lessons learned). Recognize common threats: phishing, ransomware, insider misuse, social engineering.
Traps
Questions often treat a vulnerability as a threat or a risk as a certainty. Risk exists only where threat and vulnerability meet an asset. Another trap asks for the first incident response action during active compromise - containment typically precedes eradication, but safety and evidence preservation matter. Be careful with quantitative items: exposure factor is a percentage of asset value, not a dollar amount, and ALE uses annualized frequency. Accepting risk is valid only with documented authority at the right level.
Worked Example
A server worth $40,000 has a 25% exposure factor and faces a threat expected twice per year. SLE = 40,000 × 0.25 = $10,000. ALE = 10,000 × 2 = $20,000. Rule of thumb: a control costing less than the ALE reduction it delivers is economically justified; compare residual ALE before and after.
Exam Tip
Label every scenario element as asset, threat, vulnerability, or control before choosing an answer.