General Security Considerations - Fundamentals, Risk, and Prioritization
What this domain covers
This domain checks the security literacy assumed by every other domain: the CIA triad, defense in depth, risk treatment, threat modeling, vulnerability prioritization, cryptography in practice, and supply chain exposure. Questions are usually short scenarios asking which concept applies or which finding to fix first.
Foundations
- CIA (confidentiality, integrity, availability) plus authentication, authorization, auditing and non-repudiation.
- Design principles: least privilege, defense in depth, secure defaults, fail secure, separation of duties, minimize attack surface, do not trust input.
- Risk is likelihood times impact, expressed against business context. Treatment options are mitigate, transfer, accept and avoid; accepted risk needs an owner and an expiry.
- Threat modeling happens at design, against a data-flow diagram, at trust boundaries. STRIDE gives a per-element prompt list: spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege.
- Vulnerability identifiers: CVE names the flaw, CVSS scores severity (base score 0 to 10), EPSS estimates exploitation likelihood, and the KEV catalog flags known exploited issues. None of these alone equals your risk.
- Cryptography in practice: TLS 1.2 or 1.3 in transit, strong ciphers at rest with keys in a KMS or HSM, rotation, hashing with salt for passwords, and no home-grown algorithms. Encryption without key management is decoration.
- Supply chain exposure: transitive dependencies, typosquatting, dependency confusion, malicious maintainer accounts, and unpinned versions.
Worked example
Two findings arrive the same morning. One is a CVSS 9.8 in a build-time linting tool that never ships to production. The other is a CVSS 6.5 in an internet-facing authentication library with a public exploit and evidence of scanning against the endpoint. Reasoning: CVSS measures intrinsic severity, not exposure, reachability or business impact. The build tool is not reachable by an attacker; the authentication library is exposed, exploitable and in the login path. The second is fixed first, under an emergency change, while the first is scheduled normally. EPSS and KEV membership support the call, and the decision is recorded in the risk register.
Traps that cost marks
- Treating CVSS score as a risk score without context.
- Running threat modeling only at release, or as a checklist with no data flows.
- Encrypting data but leaving keys in code, config or the same repository.
- Assuming scanning equals security; scanners find patterns, not design flaws.
- Confusing authentication with authorization in scenario answers.