Information Security: Frameworks, Controls, and Threats
Core concepts
Information security protects confidentiality, integrity, and availability. Familiarity with ISO 27001 (an information security management system), the NIST Cybersecurity Framework (identify, protect, detect, respond, recover), and COBIT governance concepts is expected. Controls are classified by timing-preventive, detective, corrective-and by nature: administrative, technical, and physical. Access control relies on least privilege, need to know, segregation of duties, and strong authentication using something you know, have, or are; multifactor authentication combines factors.
Risk and threats
Risk management identifies assets and threats, assesses likelihood and impact, then treats risk by avoiding, mitigating, transferring, or accepting it. Common threats include phishing and social engineering, malware and ransomware, insider misuse, denial-of-service attacks, and unpatched systems. Encryption protects confidentiality, hashing verifies integrity, and digital signatures support authenticity and nonrepudiation. Incident response follows preparation, detection, containment, eradication, recovery, and lessons learned. Business continuity and disaster recovery planning depend on recovery time objective (how quickly service must return) and recovery point objective (how much data loss is tolerable).
Traps
Questions frequently reverse RTO and RPO, or confuse encryption with hashing. Authentication proves identity; authorization grants permissions. Risk transfer through insurance does not transfer reputation damage. A corrective control fixes an event after detection; it is not preventive.
Worked example
A system has an RPO of 15 minutes and an RTO of 4 hours. Backups must occur at least every 15 minutes, and the recovery plan must restore service within 4 hours. A backup taken every 6 hours would violate the RPO even if recovery were fast.