Security Fundamentals and Governance
Security exists to protect the confidentiality, integrity and availability (CIA) of information, plus supporting properties such as authenticity, non-repudiation and accountability. Candidates must be able to map a control or incident to the property it protects: encryption protects confidentiality, hashing and change control protect integrity, redundancy and backups protect availability.
Governance is how an organisation decides and enforces what "secure enough" means. The board or executive sets risk appetite; a security steering committee or CISO translates it into a security program. Learn the document hierarchy, because it is heavily tested:
- Policy - mandatory, high level, states what must be achieved and who is accountable. Approved by senior management.
- Standard - mandatory, specific requirements (e.g. AES-256, 12-character minimum).
- Procedure - mandatory step-by-step how.
- Guideline - recommended, discretionary.
Supporting concepts: data classification and ownership (owner is the business accountable party, custodian operates the controls, steward maintains quality/metadata); least privilege and need-to-know; separation of duties and dual control; defense in depth; fail-safe defaults; due care (doing the right thing) versus due diligence (verifying it is done).
Traps: questions often describe a document that names a specific algorithm or parameter and call it a policy - that is a standard. "Least privilege" is about rights granted to perform a job; "need to know" is about access to specific information. Training and awareness programmes are administrative controls, not technical ones.
Rule of thumb: if the sentence says must and names an outcome, it is policy; if it says must and names a product or value, it is a standard; if it says should, it is a guideline.