Security Principles and Risk Management
Vocabulary that drives every question
An asset has value; a threat is anything (actor or event) that could harm it; a vulnerability is a weakness a threat can exploit. Risk is the combination of likelihood and impact when a threat exploits a vulnerability - it is never the same as any single one of those terms. Inherent risk exists before controls; residual risk remains after them. Business impact analysis identifies critical functions and their dependencies.
Quantitative analysis
Memorize four variables: Asset Value (AV), Exposure Factor (EF - the percentage of the asset lost in one event), Single Loss Expectancy (SLE = AV × EF), and Annualized Rate of Occurrence (ARO, events per year). Annualized Loss Expectancy is ALE = SLE × ARO. A control is cost-justified when its annual cost is below the ALE it removes, and you compare against residual risk, never against zero.
Principles
Confidentiality, integrity and availability anchor everything; authenticity and non-repudiation are frequently tested alongside them. Design principles include least privilege, need-to-know, separation of duties, dual control, least functionality, defense in depth, fail-safe defaults and zero trust (never trust, always verify).
Control taxonomy
Classify by purpose - preventive, detective, corrective, deterrent, compensating, recovery - and by nature: technical, administrative/managerial, physical. One control can carry more than one label (a fence deters and prevents; CCTV deters and detects).
Traps
Equating a vulnerability with a risk; forgetting ARO may exceed 1; assuming a control eliminates risk; mistaking a written policy for an implemented control.
Worked example
Asset $400,000, EF 25% → SLE $100,000. ARO 0.4 → ALE $40,000. A control costing $15,000/year that halves the ARO is worth it ($40,000 → $20,000 ALE).