Security Concepts: Vocabulary, Threat Models, and Control Mapping
Precision beats recall
Start with the CIA triad: confidentiality (encryption, access control), integrity (hashing, digital signatures, change control), availability (redundancy, DDoS mitigation). Control questions almost always map to one of these - hashing tests integrity, not confidentiality.
Then the terms questions deliberately blur:
- Vulnerability = a weakness. Threat = a potential cause of harm. Exploit = the code or technique that abuses the vulnerability. Risk = likelihood × impact. A malicious actor is a threat source; the unpatched server is the vulnerability, not the reverse.
- Threat actors - script kiddie, hacktivist, organized crime, insider, nation-state/APT - are usually distinguished by motivation (financial, ideological, espionage).
- Attack surface shrinks with hardening; defense in depth layers controls so one failure does not mean compromise.
Know the attack categories: malware (a virus needs a host file, a worm self-propagates, a trojan disguises itself, ransomware encrypts, a rootkit hides, a keylogger collects), social engineering (phishing, spear phishing, vishing, tailgating, pretexting), and network attacks (MITM, DoS/DDoS, spoofing).
Access control vocabulary: identification, authentication, authorization, accounting (AAA). Least privilege, need-to-know, separation of duties, and role-based access control are the usual answers for limiting insider risk.
Compliance frameworks get named directly: PCI-DSS (cardholder data), HIPAA (health information), GDPR (EU personal data), SOX (financial reporting). Match data type to framework.
Rule of thumb: before answering, decide whether the question asks what could go wrong (threat), what is weak (vulnerability), or what actually happened (incident). That single check removes most distractors.