Information Security Fundamentals and Security Awareness
Domain 1 supplies the vocabulary every later domain assumes. NISP L1 questions here are definitional and scenario-based: name the property being violated, classify a threat, or choose the human control when no technical one exists.
The CIA triad and its extensions
- Confidentiality - data is read only by authorized parties. Loss looks like a leaked customer list or an overheard call.
- Integrity - data is complete and unaltered. Loss looks like a changed transfer amount or an edited log entry.
- Availability - authorized users reach systems when needed. Loss looks like a DDoS, ransomware, or a failed disk with no spare.
- Supporting properties: authenticity (the sender is who they claim), non-repudiation (they cannot credibly deny it later), accountability (actions map to an identity through logging).
Risk language
Risk is a function of threat, vulnerability and asset value. A threat is who or what could cause harm (criminal group, insider, flood); a vulnerability is the weakness that lets it succeed (unpatched service, untrained staff, no MFA); a control reduces likelihood or impact. What remains is residual risk, and it must be accepted by an accountable business owner, not silently by the analyst.
Awareness as a real control
Most entry-level incidents start with a person: phishing and spear-phishing, vishing, pretexting, tailgating, and baiting with dropped USB drives. Testable behaviours are: verify unusual requests out of band (call a known number, never reply to the message), never share passwords or one-time codes, lock the screen when leaving, keep a clean desk, and report rather than delete suspicious mail.
Worked example
An accountant receives mail from IT Support saying her mailbox closes in two hours unless she confirms her password on a linked page. Which property is threatened and what should she do? Reasoning: the message uses authority plus urgency; the link points to a domain that is not the company's; no helpdesk needs a password. This is credential phishing against confidentiality. Correct action: do not click, report through the internal channel so the sender domain can be blocked for everyone, and if credentials were already entered, change the password and report at once. Replying to ask whether the mail is genuine simply confirms the address to the attacker.
Traps that cost marks
- Calling a phishing email a vulnerability. It is a threat vector; the user's susceptibility is the vulnerability.
- Treating deletion as resolution. Reporting is what triggers blocking, hunting and user education.
- Confusing integrity with confidentiality when a record is quietly altered rather than exposed.
- Assuming a firewall or antivirus replaces awareness training: technical controls cannot stop a user typing a password into a fake page.