Information Security and Cyber Security
Core concepts
Understand the CIA triad (confidentiality, integrity, availability) and supporting concepts such as authentication, authorization, non-repudiation, and accountability. Study symmetric versus asymmetric cryptography, hashing, digital signatures, and public key infrastructure. Know common attacks: malware, phishing, social engineering, SQL injection, cross-site scripting, man-in-the-middle, denial of service, and password attacks. Cover network defences: firewalls, IDS/IPS, VPNs, and access control models (DAC, MAC, RBAC). Understand risk management (threat, vulnerability, impact), security policies, business continuity, and legal/ethical dimensions. Familiarity with standards such as ISO 27001 and the principle of least privilege is expected.
Traps
Examiners test the difference between symmetric (one shared key, fast, key distribution problem) and asymmetric (public/private pair, slower, solves key exchange) encryption. Remember hashing is one-way and ensures integrity, not confidentiality. Distinguish authentication (who you are) from authorization (what you may do). Do not claim a firewall stops insider misuse or phishing emails by itself.
Worked example
A user sends a message signed with their private key and encrypted with the recipient's public key. The recipient decrypts with their own private key (confidentiality) and verifies the signature with the sender's public key (authenticity and integrity). Rule of thumb: encrypt with the recipient's public key, sign with your own private key.