Security, Risk, and Compliance
Protect, prove, and treat risk
Security work rests on confidentiality, integrity, and availability, but exams test how controls map to those goals. Know identity and access management: authentication proves identity; authorization decides access; RBAC grants by role, ABAC by attributes. Least privilege, separation of duties, and zero trust-never trust implicitly, verify continuously-are recurring principles. Encryption protects data in transit and at rest; hashing is one-way and suits password storage; tokenization and masking reduce exposure. Key management is part of the control, not an afterthought.
Risk management identifies assets, threats, vulnerabilities, likelihood, and impact. Treatments are avoid, mitigate, transfer (insurance), and accept-not eliminate. Compliance frameworks such as ISO 27001, SOC 2, PCI DSS, HIPAA, and GDPR demonstrate control maturity but do not by themselves make an organization secure. Incident response follows preparation, detection and analysis, containment, eradication, recovery, and lessons learned. For resilience, RTO is the maximum acceptable downtime; RPO is the maximum acceptable data loss.
Traps: swapping authentication and authorization; saying encryption hashes data; treating risk transfer as risk removal; confusing RTO with RPO; and assuming compliance equals security. Also check scope: PCI DSS applies to cardholder data environments, not every system.
Worked example: an order system has an RTO of 4 hours and an RPO of 15 minutes. Hourly backups fail the RPO; the design needs continuous replication or 15-minute log shipping, plus a tested restore within four hours.
Rule of thumb: classify data first, then choose controls proportional to impact.