Information Security Core Concepts
Domain 4 (Information Security Core Concepts) tests the technical foundation a CISO needs to challenge engineers and approve designs. You are not expected to code, but you are expected to know what each control does and does not provide.
The organizing models
- CIA triad: confidentiality, integrity, availability. Extend with authentication, authorization, accounting (AAA), and non-repudiation.
- Security is a property of systems under attack, so reason in terms of threat, vulnerability, exposure, and control rather than in lists of products.
Cryptography essentials
- Symmetric algorithms (AES) are fast but suffer key distribution problems; asymmetric algorithms (RSA, elliptic curve) solve key exchange and enable signatures; TLS is a hybrid of both.
- Hashing (SHA-256) is one-way and supports integrity checks. Password storage needs a salted, deliberately slow key-derivation function such as bcrypt or Argon2, not a fast hash.
- A digital signature is a hash of the message protected with the sender private key. It gives integrity, authenticity, and non-repudiation, but not confidentiality.
- PKI binds identities to keys through certificate authorities; revocation is published through CRL and OCSP.
Identity, access, and architecture
- Least privilege, separation of duties, RBAC versus attribute-based ABAC, privileged access management, and phishing-resistant MFA such as FIDO2.
- Joiner-mover-leaver processes and periodic access recertification are the controls auditors test most.
- Segmentation, DMZ design, zero trust (never trust, always verify), and defense in depth limit blast radius.
- Threat modeling with STRIDE, secure SDLC gates, SAST, DAST, and dependency scanning front-load assurance; OWASP Top 10 frames web risk.
- Cloud uses a shared responsibility model; the provider secures the platform, the customer secures configuration, identity, and data. Backups follow 3-2-1 with one copy offline or immutable.
Worked example
A customer portal shows a spike in failed logins using valid usernames from many IP addresses: credential stuffing with breached credentials. Password complexity rules will not help because the passwords are genuine. The fix combines preventive controls (MFA for all customers, rate limiting and bot detection, screening against breached-password lists) with detective controls (alerting on distributed failed-login patterns) to shorten dwell time. Each control is mapped to the risk it reduces before funding is requested.
Traps that cost marks
- Describing hashing as encryption, or signatures as providing confidentiality.
- Choosing asymmetric encryption for bulk data instead of hybrid key exchange.
- Confusing authentication with authorization.
- Assuming a cloud provider's certification covers customer misconfiguration.
- Placing an intrusion prevention system out of line and expecting it to block traffic.