Cyber Security Fundamentals
What this domain tests
Cyber Security Fundamentals covers the vocabulary and models the exam reuses everywhere: asset, threat, vulnerability, risk, confidentiality, integrity and availability (CIA), cyberspace, and the difference between information security and cyber security. Expect definition-matching and short scenario questions that ask you to classify a situation, not to configure a tool.
Core rules and concepts
- CIA triad: confidentiality stops unauthorised disclosure; integrity stops unauthorised or accidental modification; availability keeps information and services usable when needed.
- Asset → threat → vulnerability → risk: an asset is anything of value; a threat is a potential cause of harm; a vulnerability is a weakness that a threat can exploit; risk is the combination of likelihood and impact.
- Risk is not eliminated: controls reduce likelihood or impact, leaving residual risk that management must accept, transfer, avoid or mitigate.
- Control families: preventive, detective and corrective; administrative, technical and physical. A single control can sit in more than one family.
- Cyberspace and cyber security: ISO/IEC 27032 describes cyberspace as the interaction of people, software and services on the internet; cyber security preserves CIA in that environment. Information security is broader because it covers all information, including paper and verbal.
- Security is a business problem: asset owners accept risk; security staff advise and implement.
Worked example
A customer database sits on an unpatched web server. The database is the asset; a criminal group is the threat; the missing patch is the vulnerability. The team rates likelihood 4 and impact 5, giving a risk score of 20 (high). Patching reduces likelihood to 2, while a web application firewall and monitoring add defence in depth; the score falls to 10 (medium). The remaining 10 is residual risk. The team does not claim zero risk; it records the residual risk and the owner accepts it with a review date.
Traps that cost marks
- Calling the missing patch a threat. It is a vulnerability; the attacker is the threat.
- Saying a control 'removes' risk. It reduces risk to a residual level.
- Treating cyber security as only technical. People, processes and physical controls are in scope.
- Mixing integrity with availability: deleting data is an integrity and availability issue, not confidentiality.
- Assuming information security equals cyber security. Cyber security is the cyberspace subset.