Information Systems Security and Risk
Risk is likelihood times impact, then treated
Information security protects confidentiality, integrity and availability of information. Risk management identifies threats and vulnerabilities, estimates likelihood and impact, and selects a treatment: avoid, reduce, transfer or accept. Candidates should be able to run that chain on any scenario and to name the control that fits.
Concepts to master
- Threat, vulnerability, risk and control: a threat exploits a vulnerability; risk is the potential loss; a control modifies it. Residual risk remains after treatment and must be accepted by an accountable owner.
- Identity and access: authentication factors, least privilege, role-based access, privileged access management, joiner-mover-leaver processes, periodic access reviews.
- Defence in depth: network segmentation, firewalls, endpoint protection, patching, encryption at rest and in transit, logging and monitoring.
- Human and process controls: security awareness, phishing simulation, incident response plans, business continuity and disaster recovery with defined recovery time and recovery point objectives.
- Third-party and cloud risk: shared responsibility models, vendor due diligence, data residency and exit plans.
- Regulatory context: personal data protection duties, breach notification, and records retention.
Traps in questions
- Choosing a detective control (logging) where the question asks to prevent an event.
- Confusing recovery time objective (how fast service returns) with recovery point objective (how much data loss is tolerable).
- Assuming the cloud provider secures everything; the customer retains responsibility for identity, data and configuration.
- Treating risk acceptance as a failure. It is a valid, documented decision by the right authority.
Worked rule of thumb
Rank treatments by risk reduction per unit of cost and disruption. For a ransomware scenario: backups and tested restore reduce impact; patching and email filtering reduce likelihood; cyber insurance transfers residual financial loss. Document the residual risk and its owner.