Information Security Fundamentals and Security Management
Information Security Fundamentals and Security Management supplies the vocabulary the rest of the NISP Level 2 paper assumes: what security actually protects, how risk is expressed, and how an organisation converts policy into repeatable controls. Questions in this domain are scenario-based, so you must apply the concepts rather than recite definitions.
Core properties
- Confidentiality - data is read only by authorised subjects (encryption, access control, classification).
- Integrity - data and systems are not altered without detection (hashing, MAC, audit trails, version control).
- Availability - services remain reachable when needed (redundancy, backups, anti-DDoS capacity).
- Secondary properties examiners test alongside: authenticity, non-repudiation, accountability/traceability, and controllability (可控性), which Chinese standards emphasise strongly.
The risk equation
Risk expresses likelihood and impact of loss: risk = threat × vulnerability × asset value, moderated by existing controls. A threat is who or what may cause harm (attacker, insider, flood); a vulnerability is the weakness that lets it succeed (unpatched service, missing policy); asset value is what is at stake. Controls reduce vulnerability (patching), reduce threat likelihood (blocking, filtering), or reduce impact (backups, insurance). Residual risk is what survives treatment and must be formally accepted by a named risk owner.
Management system
Security management follows a PDCA cycle - Plan (policy, scope, risk assessment), Do (implement controls), Check (audit, metrics, internal review), Act (corrective action). Policy sits in a hierarchy: overall security policy, then management and technical standards, then procedures, then records. Supporting areas include asset classification and labelling, personnel security (screening, onboarding, termination), physical and environmental security, supplier and third-party management, and awareness training.
Worked example
A web server runs an unpatched CMS (vulnerability), is internet-facing (threat: automated scanning bots), and stores 50,000 customer records (high asset value). The team applies the vendor patch and adds a WAF. The patch removes the exploit path; the WAF lowers the likelihood of future exploitation; neither reduces impact. A tested offline backup is then added to reduce impact, lowering residual risk, which the risk owner signs off.
Traps
- Confusing threat with vulnerability: "weak password" is a vulnerability, "credential-stuffing bot" is a threat.
- Treating risk as purely technical; management, supplier and physical risk all count.
- Assuming a control eliminates risk rather than reducing it to a residual level.
- Forgetting that asset classification drives every later control decision.