Information Security Fundamentals and Security Awareness
This domain tests the vocabulary every later domain depends on: the CIA triad, the asset–threat–vulnerability–risk chain, the difference between authentication, authorization and accountability, and the idea that a trained user is a genuine security control. Expect definition-matching items and short scenarios where you must choose the precise term rather than the closest-sounding one.
Separate the four risk words
- Asset: anything of value - data, laptops, credentials, reputation, service availability.
- Threat: a potential cause of harm - an attacker, malware, a flood, an insider.
- Vulnerability: a weakness a threat can exploit - unpatched software, a reused password, an unlocked door.
- Risk: the likelihood and impact of a threat exploiting a vulnerability against an asset. Controls reduce likelihood or impact; they never remove the threat.
Three letters, three questions
Confidentiality asks who may read it. Integrity asks whether it is still accurate and unaltered. Availability asks whether it can be used when needed. Authentication proves identity; authorization decides permissions; accountability through audit logging ties actions to an identity, and non-repudiation means a party cannot credibly deny an action.
Principles that show up in scenarios
- Least privilege and need to know.
- Separation of duties and dual control for sensitive actions.
- Defense in depth: no single control is trusted alone.
- Fail securely: a failure should deny access, not grant it.
- Awareness is a detection sensor and a prevention layer, not a replacement for technical controls.
Worked example
A nurse leaves a work laptop on a train. The asset is the laptop plus the patient data on it. The threat is a thief or a curious finder. The vulnerabilities are missing full-disk encryption, no screen lock and a weak login. The risk is high because the data is regulated. Controls in order of value: full-disk encryption converts a data breach into a hardware loss; a strong login and screen lock slow access; remote wipe and asset tracking aid recovery; the reporting procedure starts the incident clock. Note that train travel is not a vulnerability and the thief is not the risk.
Marks that are easy to lose
- Calling a vulnerability a threat, or saying risk equals threat.
- Claiming encryption protects availability.
- Treating awareness training as a technical control.
- Swapping authentication and authorization.
- Forgetting that backups primarily serve availability and recovery.